EUVD-2026-79200
GHSA-w2h5-pgm6-hg28
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description explicitly states unauthenticated remote arbitrary code execution with complete system compromise, supporting AV:N/AC:L/PR:N/UI:N and full C/I/A impact; scope unchanged as compromise is of the gateway host itself.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
Lifecycle Timeline
3DescriptionCVE.org
Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to execute arbitrary code. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
AnalysisAI
Unauthenticated remote code execution affects HPE Networking EdgeConnect SD-WAN Gateways running firmware in the 9.4.x, 9.5.x, 9.6.x, and 9.7.0.0 branches, where a buffer overflow in an underlying operating system service permits a network-reachable attacker to run arbitrary commands and fully compromise the appliance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) and the independent assessment agree that no credentials or user interaction are needed, so the practical limiting factor is whether the vulnerable interface is reachable from an untrusted network. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable against HPE Networking EdgeConnect SD-WAN Gateways running affected firmware (9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0) with network reachability to the vulnerable OS-level service. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority vulnerability, and the signals are internally consistent rather than inflated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: upgrade every affected EdgeConnect SD-WAN Gateway to a fixed firmware release above the top of its branch (above 9.4.8.2, 9.5.8.1, 9.6.3.1, and 9.7.0.0 respectively), with the exact fixed build numbers to be confirmed against the HPE advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05135en_us&docLocale=en_US since the provided intelligence does not enumerate them; coordinate upgrades in maintenance windows because failover and tunnel renegotiation can cause transient outages on HA pairs. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, produce a complete inventory of every HPE Networking EdgeConnect SD-WAN Gateway appliance running the 9.4.x, 9.5.x, 9.6.x, or 9.7.0.0 firmware branches, and for each one determine whether its vulnerable interface is reachable from an untrusted network; where it is, immediately restrict that exposure to trusted management networks or trusted source addresses using firewall rules, ACLs, or upstream filtering, and confirm the restriction is enforced rather than merely configured. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a craf
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S
A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access
A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service
NTP through 4.2.8p12 has a NULL Pointer Dereference. Rated high severity (CVSS 7.5), this vulnerability is remotely expl
Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenti
Remote authentication bypass in HPE AutoPass License Server (APLS) allows unauthenticated network attackers to circumven
Information disclosure in the HPE Aruba EdgeConnect SD-WAN Orchestrator allows a remote attacker holding only a valid re
Privilege escalation in HPE Networking EdgeConnect SD-WAN Orchestrator (builds 9.4.0 through 9.4.10, 9.5.0 through 9.5.8
Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API allows a remote, low-privileged but authe
Share
External POC / Exploit Code
Leaving vuln.today