Dell Secure Connect Gateway SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Dell Secure Connect Gateway (SCG) Application and Appliance, in versions prior to 5.28. This vulnerability arises from improper handling of special elements in SQL commands, allowing a high-privilege attacker with local access to the system to exploit it. The exploitation could lead to the disclosure of non-sensitive information, excluding any customer data.

Impact

Exploitation of this vulnerability could result in unauthorized access to non-sensitive information, with the potential for SQL injection attacks to be used as a precursor to more severe exploits, such as executing arbitrary code or escalating privileges.

Remediation

Users can upgrade to version 5.28.00 or later to address this vulnerability. Drivers for the updated version are available on the Dell Support website for both the Application and Appliance editions of Secure Connect Gateway.