Executive brief
HPE Networking EdgeConnect SD-WAN Gateways are appliances used to optimize and secure branch office network traffic. A buffer overflow vulnerability in the gateway's API allows authenticated administrators to execute arbitrary commands on the device, potentially compromising network operations and enabling lateral movement into protected networks.
Technical details
A buffer overflow vulnerability exists in an API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. The vulnerability requires authentication with Admin privilege to exploit. An authenticated remote attacker can trigger the buffer overflow condition to achieve arbitrary code execution on the underlying operating system of the gateway device. Attack vector is network-based and requires both valid credentials and Admin-level permissions.
Affected products
- HPE EdgeConnect SD-WAN Gateways
Timeline
- 2026-09-15: disclosed