EUVD-2026-79206
GHSA-4r8v-7f5q-9mr7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Network-reachable API with low-privilege auth (PR:L) and no interaction; SSRF pivots into the internal host so S:C, with primarily disclosure impact (C:H, minor I:L, no A).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
3DescriptionCVE.org
Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery (SSRF) attacks. A successful exploit allows an attacker to enumerate information about the internal structure of the EdgeConnect SD-WAN Orchestrator host leading to potential disclosure of sensitive information beyond what is authorized by the user's existing privilege level.
AnalysisAI
Server-side request forgery in the EdgeConnect SD-WAN Orchestrator API lets any remote user who already holds valid low-privilege credentials redirect server-side fetches to attacker-chosen internal destinations, mapping the internal structure of the Orchestrator host and disclosing sensitive information beyond that user's authorized privilege level. The issue is network-reachable at low attack complexity with no user interaction (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 8.5), and the scope change reflects the pivot out of the API context into the host/network fabric. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires valid authenticated access to the EdgeConnect SD-WAN management API at a low privilege level (PR:L) - the attacker must already hold working credentials, so this is not exploitable by fully unauthenticated actors. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 8.5) describes a network-reachable, low-complexity SSRF requiring only low-privilege authentication, with a scope change (S:C) reflecting that the forged request pivots from the API context into the internal host/network. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No specific fixed version appears in the supplied intelligence, so the primary action is to obtain the corrected firmware/software release from the HPE advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US and upgrade every instance in the 9.4.x, 9.5.x, 9.6.x, and 9.7.0 lines named by EUVD to a build the advisory marks as resolved; verify with HPE support whether the fix applies to the Orchestrator, the Gateway, or both before assuming a single upgrade closes the issue. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all EdgeConnect SD-WAN Orchestrator and Gateway instances, focusing on versions 9.4.0 through 9.7.0, and restrict API access to trusted management networks only; review logs for anomalous internal fetch requests. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a craf
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S
A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access
A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service
NTP through 4.2.8p12 has a NULL Pointer Dereference. Rated high severity (CVSS 7.5), this vulnerability is remotely expl
Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenti
Remote authentication bypass in HPE AutoPass License Server (APLS) allows unauthenticated network attackers to circumven
Information disclosure in the HPE Aruba EdgeConnect SD-WAN Orchestrator allows a remote attacker holding only a valid re
Privilege escalation in HPE Networking EdgeConnect SD-WAN Orchestrator (builds 9.4.0 through 9.4.10, 9.5.0 through 9.5.8
Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API allows a remote, low-privileged but authe
Share
External POC / Exploit Code
Leaving vuln.today