EdgeConnect SD-WAN Gateways vulnerability

What happened

Vulnerabilities have been identified in the API of HPE Networking EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete compromise of the EdgeConnect SD-WAN Orchestrator host.

Affected versions

EdgeConnect SD-WAN Gateways: 9.7.0 through 9.7.0 (semver); 9.6.0 through 9.6.3 (semver); 9.5.0 through 9.5.8 (semver); 9.4.0 through 9.4.10 (semver) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.