Executive brief
HPE's EdgeConnect SD-WAN Gateway is a network appliance that securely connects distributed branch offices and remote workers. A buffer overflow in its management API allows authenticated attackers to run arbitrary commands with elevated privileges on the underlying system, potentially compromising the gateway's integrity and gaining control over network traffic routing.
Technical details
The vulnerability is a buffer overflow affecting the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Attack vectors require prior authentication, reducing immediate exposure to anonymous attackers. Successful exploitation allows an authenticated remote attacker to execute arbitrary commands with privileged access on the underlying operating system. The vulnerability is rooted in insufficient input validation or bounds checking in the API handler. Fix/patch availability should be confirmed via HPE's security advisories.
Affected products
- HPE EdgeConnect SD-WAN Gateway <UNKNOWN>
Timeline
- 2026-09-15: disclosed