EUVD-2026-79223
GHSA-42pm-2rhh-gm2h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Authenticated network access to the management interface with an ordinary low-privilege account (PR:L), no user interaction, and confidentiality-only impact.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking EdgeConnect SD-WAN Gateways.
AnalysisAI
EdgeConnect SD-WAN Gateways expose sensitive information to any user who can authenticate to the web-based management interface with low privileges, letting them read data that can be reused to reach other network services managed by the gateway. All four supported branches listed by ENISA (9.4.0.0-9.4.8.2, 9.5.0.0-9.5.8.1, 9.6.0.0-9.6.3.1, and 9.7.0.0) are affected, per HPE's advisory hpesbnw05135en_us. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Risk Assessment | The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is internally consistent and credible: remote and low-complexity, but gated behind authentication (PR:L), with no integrity or availability impact, so the base score lands at 6.5 rather than critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No fixed release version is stated in the supplied data, so the primary action is to consult HPE's advisory (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US) for the patched firmware per branch and upgrade the appliance management plane accordingly - the presence of 9.7.0.0 in the affected list suggests the fix will be a maintenance release above those branch ceilings rather than a back-port. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today