Arubanetworks
Monthly
Unauthenticated remote denial-of-service in HPE Networking EdgeConnect SD-WAN Gateways (formerly Silver Peak), affecting firmware branches 9.4.x up to 9.4.8.2, 9.5.x up to 9.5.8.1, 9.6.x up to 9.6.3.1, and 9.7.0.0. An attacker who can reach the vulnerable gateway service can exhaust resources (CWE-400, uncontrolled resource consumption), rendering certain services on the appliance unavailable and disrupting SD-WAN connectivity for sites behind the gateway. The CVSS 3.1 score is 7.0 (AV:N/AC:H/PR:N/UI:N), and no public exploit code or CISA KEV listing was identified at time of analysis.
Adjacent-network attackers can crash HPE Networking EdgeConnect SD-WAN Gateways or leak small amounts of uninitialized stack memory by sending crafted traffic to the gateway, affecting unauthenticated devices reachable from the same Layer 2 segment. The flaw (CWE-200) carries a 7.1 CVSS score with the availability impact rated High and confidentiality impact Low, and it spans four maintained release trains from 9.4.0.0 through 9.7.0.0. It is not listed in CISA KEV, no public exploit code was identified in the supplied intelligence, and no EPSS probability was provided, so the immediate risk is driven by network adjacency and gateway exposure rather than confirmed mass exploitation.
A buffer overflow in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways allows an attacker who already holds high-privilege API credentials to execute arbitrary commands as a privileged operating-system user on the gateway appliance. Affected releases span the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches, per ENISA EUVD version ranges. The CVSS 3.1 vector requires PR:H, meaning exploitation is not unauthenticated; no public exploit was identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated attackers holding administrative access to the management plane of HPE Networking EdgeConnect SD-WAN Gateways can supply crafted input to an affected component and achieve arbitrary command execution as root. The flaw affects multiple released trains — 9.4.x up to 9.4.8.2, 9.5.x up to 9.5.8.1, 9.6.x up to 9.6.3.1, and 9.7.0.0 — with a CVSS base score of 7.2 reflecting the high privilege prerequisite against total loss of confidentiality, integrity, and availability. There is no CISA KEV entry, no EPSS score, and no public exploit code identified at time of analysis, so this is currently a high-impact but credential-gated risk rather than an actively exploited one.
Authenticated attackers who already hold administrative privileges on HPE Aruba EdgeConnect SD-WAN Gateways can supply specially crafted configuration data that overflows a stack buffer in the configuration processing logic, potentially yielding remote code execution as root or crashing the gateway into a denial of service. The flaw affects gateway releases in the 9.4.x (≤9.4.8.2), 9.5.x (≤9.5.8.1), 9.6.x (≤9.6.3.1) and 9.7.0.0 branches per the ENISA EUVD affected-version list, and carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No public exploit code, CISA KEV listing or EPSS score was included in the supplied intelligence, so the observed exploitation status is unconfirmed at time of analysis.
Authentication controls protecting the web-based management interface of HPE Aruba EdgeConnect SD-WAN Orchestrator can reportedly be circumvented by a remote actor, allowing escalation to administrative privileges and full compromise of the orchestrator host that manages the SD-WAN fabric. Reported affected releases span EdgeConnect SD-WAN software 9.4.0 through 9.7.0, with no fix version disclosed in the supplied source data. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so exploitation status is best treated as unconfirmed.
Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API lets an attacker who already holds a low-privilege account elevate to root and run arbitrary operating-system commands on the appliance. The flaw is remotely reachable (AV:N) but requires authentication plus a high-complexity exploitation path per the assigned CVSS vector (7.5, AC:H, PR:L). No public exploit code or CISA KEV entry was present in the supplied intelligence, so this is currently a post-authentication hardening priority rather than an actively exploited zero-day.
Unauthenticated remote denial-of-service in HPE Networking EdgeConnect SD-WAN Gateways, where a flaw in the appliance's underlying operating system lets a network-reachable attacker crash or stall an affected service. All four maintained branches are impacted — 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0 — with CVSS 7.5 reflecting a high availability impact and no confidentiality or integrity loss. No public exploit code and no CISA KEV listing were present in the source data at time of analysis, so this is currently a patch-now availability risk rather than a confirmed active campaign.
Unauthenticated remote code execution and denial-of-service in HPE Aruba Networking EdgeConnect SD-WAN Gateways (versions 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1, and 9.7.0.0) arise from flawed parsing of malformed or truncated packets in the proxy packet-processing path, where incorrect length arithmetic triggers an integer overflow that can become a memory-corruption (buffer overflow) condition. Successful exploitation can let a network-positioned attacker execute code or crash the gateway, taking down the SD-WAN overlay. The HPE advisory at support.hpe.com confirms affected version ranges, but there is no CISA KEV listing, no EPSS score, and no public exploit code identified at time of analysis, so this is currently a patch-now, watch-for-exploitation item rather than a confirmed active campaign.
Unauthenticated remote attackers can circumvent the authentication controls exposed by the API of HPE Networking EdgeConnect SD-WAN Orchestrator, escalating to administrative privileges and achieving complete compromise of the orchestrator host. The vendor rates this 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), and EUVD maps the affected code lines to EdgeConnect SD-WAN releases 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0. No CISA KEV listing or public exploit code was identified in the supplied intelligence, and EPSS data was not provided, so the practical exploitation risk rests on the high attack complexity (AC:H) noted in the vendor vector.
A buffer overflow in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways allows an unauthenticated remote attacker to execute arbitrary commands on the underlying host, resulting in full operating-system compromise of the appliance. Multiple maintenance trains are affected — 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and the 9.7.0.0 release. The vendor's own CVSS rating is 8.1 (AV:N/AC:H/PR:N/UI:N), reflecting that exploitation is unauthenticated but gated by preconditions outside the attacker's control; no public exploit code or CISA KEV listing was identified at time of analysis.
A limited buffer overflow in the network security monitoring component of HPE EdgeConnect SD-WAN Gateways allows an unauthenticated remote attacker to crash the appliance and potentially execute code by driving crafted traffic into the monitoring parser. ENISA EUVD lists four affected release trains: 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0. No CISA KEV entry and no public exploit code were identified at time of analysis, and no EPSS data was supplied with the record.
Incorrect authorization in the EdgeConnect SD-WAN Orchestrator API lets an authenticated remote user with low privileges retrieve sensitive information beyond what their role permits, and that data can potentially be leveraged to reach the SD-WAN network services the orchestrator manages. The vendor HPE/Aruba rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), and ENISA EUVD lists affected EdgeConnect SD-WAN Gateway releases in the 9.4.x, 9.5.x, 9.6.x and 9.7.0 lines. No public exploit code exists and the issue is not in CISA KEV at time of analysis; exploitation requires valid low-privilege credentials, which materially narrows the attacker population.
Server-side request forgery in the EdgeConnect SD-WAN Orchestrator API lets any remote user who already holds valid low-privilege credentials redirect server-side fetches to attacker-chosen internal destinations, mapping the internal structure of the Orchestrator host and disclosing sensitive information beyond that user's authorized privilege level. The issue is network-reachable at low attack complexity with no user interaction (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 8.5), and the scope change reflects the pivot out of the API context into the host/network fabric. No public exploit code was identified at time of analysis and no CISA KEV entry is associated with this CVE; note that the description names the Orchestrator while the ENISA EUVD record lists EdgeConnect SD-WAN Gateway builds 9.4.0 through 9.7.0, so the exact affected component should be confirmed against the HPE advisory before scoping exposure.
Unauthenticated attackers positioned on an adjacent network segment can crash HPE Networking EdgeConnect SD-WAN Gateway appliances by sending crafted traffic, causing a denial of service that the device cannot recover from without manual intervention. All four maintained firmware branches are affected: 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0. The vendor rates this 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) and the only publicly indexed advisory is HPE's own security bulletin (hpesbnw05135en_us); no CISA KEV listing, EPSS score, or public proof-of-concept code was present in the supplied intelligence, so active exploitation is unconfirmed.
Low-privilege authenticated attackers can escalate to root on HPE Networking EdgeConnect SD-WAN Gateways by abusing an API endpoint, gaining the ability to run arbitrary operating-system commands. The flaw carries a CVSS base score of 8.8 (AV:N/AC:L/PR:L/UI:N), meaning the attacker needs only valid low-privileged credentials and network reachability to the management API — no user interaction is required. Affected branches span EdgeConnect SD-WAN Gateways 9.4.x through 9.7.0.0; no public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis.
Privilege escalation in the EdgeConnect SD-WAN Gateway API lets a remote, authenticated low-privileged user gain administrative rights on the web-management interface, resulting in complete compromise of the gateway (CVSS 8.8, AV:N/PR:L). Affected branches are 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1, and 9.7.0.0. No public exploit code, EPSS score, or CISA KEV listing was provided at time of analysis; exploitation requires a valid low-privileged account and reachability of the management API.
A buffer overflow in the underlying operating system of HPE Aruba Networking EdgeConnect SD-WAN Gateways lets an unauthenticated attacker on an adjacent network segment execute arbitrary code as a privileged OS user, resulting in full compromise of the appliance. Affected branches span the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 release trains (up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively). The vendor describes exploitation as conditional on preconditions outside the attacker's control, and no public exploit code, EPSS score or CISA KEV entry was present in the supplied intelligence at time of analysis.
Authenticated command injection in the command-line interface of HPE Aruba EdgeConnect SD-WAN Gateways allows an attacker who already holds high-privileged CLI credentials to break out of the appliance shell and execute arbitrary commands on the underlying operating system, resulting in complete compromise of the gateway. The flaw affects the 9.4.x, 9.5.x, 9.6.x and 9.7.x maintenance streams (9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1 and 9.7.0.0) and carries a vendor-assigned CVSS of 9.1 with a scope change from the CLI component to the host OS. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so the practical priority is driven by exposure of the management CLI rather than by evidence of active exploitation.
Unauthenticated remote code execution affects HPE Networking EdgeConnect SD-WAN Gateways running firmware in the 9.4.x, 9.5.x, 9.6.x, and 9.7.0.0 branches, where a buffer overflow in an underlying operating system service permits a network-reachable attacker to run arbitrary commands and fully compromise the appliance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) and the independent assessment agree that no credentials or user interaction are needed, so the practical limiting factor is whether the vulnerable interface is reachable from an untrusted network. No public exploit code has been identified at time of analysis and the issue has not been confirmed actively exploited (CISA KEV), but the severity, the network-edge placement of these devices, and the credential-free attack path make this a top-priority patch item for exposed gateways.
Unauthenticated remote attackers can bypass authentication controls in the EdgeConnect SD-WAN Orchestrator management API to gain administrative privileges and fully compromise the underlying host, rated 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Affected builds per the EUVD advisory span EdgeConnect SD-WAN 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0, although the description attributes the flaw to the Orchestrator while EUVD lists Gateways, so the exact affected component should be confirmed against HPE advisory hpesbnw05135en_us. No public exploit identified at time of analysis and no CISA KEV entry, but the unauthenticated, network-reachable attack path and total confidentiality, integrity, and availability impact make this a top-priority exposure wherever the management API is internet-facing.
Information disclosure in the HPE Aruba EdgeConnect SD-WAN Orchestrator allows a remote attacker holding only a valid read-only account to retrieve sensitive configuration data, including third-party API tokens and credentials, by sending a specially crafted request to the cache synchronization endpoint. The vendor-supplied score of 9.9 reflects a scope-changed vector with high confidentiality and integrity impact, whereas independent reassessment places the realistic impact at confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), because the flaw leaks data rather than altering system state. No CISA KEV entry and no public exploit code were identified at time of analysis, so the practical risk scales with how broadly low-privilege accounts are provisioned and whether the Orchestrator management interface is reachable from untrusted networks.
Privilege escalation in HPE Networking EdgeConnect SD-WAN Orchestrator (builds 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0) allows an authenticated, low-privileged user of the Orchestrator API to elevate themselves to an administrative role and take full control of the SD-WAN management plane. The issue is network-reachable, low complexity, and needs no user interaction (CVSS 3.1 AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact), but it is not exploitable before authentication, so the realistic attack surface is limited to deployments that hand out Orchestrator accounts - multi-tenant, self-service, or otherwise heavily populated role models, and far less so to single-admin environments. No public exploit code has been identified at time of analysis and the issue is not listed as actively exploited (no CISA KEV entry); the vendor rates it 9.9 with a scope change, while our independent assessment agrees on the impact metrics but scores it without a scope change.
Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API allows a remote, low-privileged but authenticated user to raise their permissions to administrative level, resulting in complete compromise of the management plane. Only holders of a valid low-privilege API account with network reachability to the API can trigger it (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), so the practical risk depends on how API accounts are provisioned and whether the management interface is segmented away from untrusted networks. Our assessment scores the issue as scope-unchanged (S:U) rather than the 9.9 / S:C vendor figure, which makes this a genuine high-priority issue rather than a CVSS-inflated one; no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV. Note that the affected version data names EdgeConnect SD-WAN Gateways while the description names the Orchestrator, so the exact affected component should be confirmed against the HPE advisory.
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unauthenticated memory disclosure in HPE Networking EdgeConnect SD-WAN Gateways lets an attacker on an adjacent network segment read portions of system memory, exposing internal service details and workflow information. All shipping 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches are affected per the vendor-published version ranges. The CVSS score is only 4.3 (confidentiality-only, adjacent vector) and there is no public exploit code or CISA KEV listing, so this is best treated as a reconnaissance enabler rather than a standalone compromise — its value to an adversary is in chaining it with a separate privilege-escalation or authentication flaw.
Unauthenticated remote attackers can query an API endpoint in HPE Networking EdgeConnect SD-WAN Orchestrator and read security-relevant configuration details and security feature status. The flaw is a CWE-200 information exposure rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, with only a low confidentiality impact and no integrity or availability impact), so it does not by itself compromise the platform but hands an adversary reconnaissance material that directly enables follow-on attacks against the managed SD-WAN fabric. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Authenticated attackers holding Admin privileges on HPE Networking EdgeConnect SD-WAN Gateways can send a crafted request to an API endpoint and trigger a classic buffer overflow (CWE-120), potentially achieving arbitrary command execution on the appliance's underlying operating system. ENISA EUVD lists affected builds across the 9.4.x, 9.5.x, 9.6.x and 9.7.x release branches, with the HPE advisory as the sole authoritative reference. No public exploit code and no CISA KEV entry were reported at time of analysis, and the vendor's 5.5 CVSS score omits any confidentiality impact despite the description claiming full OS-level command execution.
Authenticated administrators of the HPE (Aruba) EdgeConnect SD-WAN Orchestrator web management interface can be tricked into running attacker-supplied script in their own browser session, exposing data handled by the management plane. The flaw is a cross-site scripting (CWE-79) issue rated CVSS 5.5 with a scope change (S:C), meaning the injected code runs in the victim's browser context rather than inside the orchestrator process itself. There is no public exploit identified at time of analysis and the issue does not appear on CISA KEV, but exploitation requires an already-authenticated account, so the practical risk depends heavily on how many privileged accounts exist and how well the UI is network-restricted.
A buffer overflow in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways allows an authenticated administrator to crash or destabilize the appliance, producing a denial-of-service condition. All maintenance branches 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0 are affected per ENISA EUVD tracking. The CVSS base of 5.5 with PR:H reflects that high administrative privileges are required, so this is not an unauthenticated remote outage; no public exploit code or CISA KEV listing was identified at time of analysis.
Denial of service in HPE Networking EdgeConnect SD-WAN Gateways lets an authenticated local attacker with low privileges destabilize the appliance operating system and disrupt traffic forwarding. Affected builds span the 9.4.x, 9.5.x, 9.6.x and 9.7.x branches — up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively — and the trigger is both local-only and high-complexity, which keeps the CVSS score at 5.8 despite the High availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, so the practical priority is patch hygiene on devices where local or delegated accounts exist.
The API endpoint exposed by HPE Networking EdgeConnect SD-WAN Gateways can be queried by an unauthenticated remote attacker in a way that returns sensitive information, with successful exploitation yielding data that could be reused to reach other network services. Affected firmware spans the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches, and exploitation is rated high complexity (AC:H) even though no authentication is required. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so this is currently a targeted-risk disclosure bug rather than a mass-exploitation event.
Unauthenticated remote denial-of-service in HPE Networking EdgeConnect SD-WAN Gateways lets an attacker who can reach the appliance's exposed services interrupt normal operation and take the gateway's services offline, disrupting WAN connectivity for dependent sites. Affected branches are 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1 and 9.7.0.0, reported by HPE's own security-alert address. CVSS is 5.9 with a high attack-complexity qualifier and availability-only impact, and no public exploit code or confirmed active exploitation was identified at time of analysis.
A buffer overflow in a system service of the underlying operating system on HPE Networking EdgeConnect SD-WAN Gateways allows an unauthenticated attacker who already sits on an adjacent network segment to crash the affected service, temporarily disrupting SD-WAN and branch network operations. All editions of the 9.4.x (up to 9.4.8.2), 9.5.x (up to 9.5.8.1), 9.6.x (up to 9.6.3.1) and 9.7.0.0 releases are listed as affected by the vendor. The impact is degraded availability rather than confidentiality or code execution, exploitation requires high attack complexity, and no public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated command injection in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways (9.4.x, 9.5.x, 9.6.x and 9.7.0.0) lets a remote user who already holds limited access privileges submit specially crafted input that is passed to the underlying operating system, resulting in arbitrary command execution with elevated privileges or a denial-of-service condition on the appliance. The vendor-assigned CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) frames this as an availability-weighted, post-authentication issue rather than a pre-auth compromise. No CISA KEV listing, EPSS score or public proof-of-concept was supplied, so exploitation status is 'no public exploit identified at time of analysis'.
EdgeConnect SD-WAN Gateways expose sensitive information to any user who can authenticate to the web-based management interface with low privileges, letting them read data that can be reused to reach other network services managed by the gateway. All four supported branches listed by ENISA (9.4.0.0-9.4.8.2, 9.5.0.0-9.5.8.1, 9.6.0.0-9.6.3.1, and 9.7.0.0) are affected, per HPE's advisory hpesbnw05135en_us. The flaw is rated 6.5 (network vector, low privileges, no user interaction, confidentiality-only impact); no public exploit code and no CISA KEV listing were identified at time of analysis, so exploitation currently depends on an attacker already holding valid low-privilege credentials and reachability to the management interface.
Unauthenticated denial of service in HPE Networking EdgeConnect SD-WAN Gateways allows an attacker who already sits on an adjacent network segment to crash the appliance, with the added consequence that the gateway cannot reboot itself and requires manual intervention to recover. Affected releases span the 9.4, 9.5, 9.6 and 9.7 maintenance trains (up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively) per the ENISA EUVD record. The flaw is rated CVSS 6.5 (AV:A/AC:L/PR:N/UI:N, availability-only impact) and no public exploit code has been identified at time of analysis; there is no CISA KEV listing.
A buffer overflow in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways lets an unauthenticated remote attacker send specially crafted packets to an affected service and corrupt its memory. Rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, CWE-120), successful exploitation degrades the integrity and availability of the gateway service without exposing confidential data. No CISA KEV listing and no public exploit code were identified in the supplied intelligence, and no EPSS score was provided, so exploitation is currently assessed as opportunistic rather than confirmed in the wild.
Privilege escalation in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways lets an authenticated, already high-privileged remote user exceed their assigned authorization level and execute arbitrary code on the appliance. Four release branches are affected: 9.4.0.0-9.4.8.2, 9.5.0.0-9.5.8.1, 9.6.0.0-9.6.3.1 and 9.7.0.0. The CVSS score of 6.6 understates the operational weight of the flaw because a compromised SD-WAN gateway sits on the control plane of the whole WAN fabric; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
ArubaOS access points are vulnerable to gateway impersonation attacks when clients connect via wired or wireless interfaces, allowing unauthenticated attackers to redirect network traffic into a man-in-the-middle position. An attacker can exploit address-based spoofing to intercept or modify data streams intended for the legitimate gateway, compromising the confidentiality of client communications. No patch is currently available.
Arubaos contains a vulnerability that allows attackers to bypass Layer 2 (L2) communication restrictions between clients and redirect traf (CVSS 4.3).
Arubaos contains a vulnerability that allows attackers to redirect intercepted traffic to facilitate machine-in-the-middle (MitM) attacks (CVSS 4.3).
Traffic interception in ArubaOS Wi-Fi networks allows adjacent attackers to bypass BSSID isolation controls and redirect victim traffic by exploiting port associations across multiple wireless networks. Successful attacks could enable eavesdropping, session hijacking, or denial of service without authentication or user interaction. No patch is currently available for this medium-severity vulnerability.
Malicious actors can install unauthorized Group Temporal Keys on ArubaOS wireless clients through a standardized roaming protocol vulnerability, enabling frame injection and network segmentation bypass. An attacker positioned on the local network could leverage this to intercept traffic, bypass client isolation, and compromise network integrity and confidentiality. No patch is currently available.
Improper cryptographic validation in ArubaOS Wi-Fi encryption allows adjacent network attackers to forge authenticated frames by spoofing the primary BSSID and inject tampered data to targeted clients without authentication. This medium-severity flaw (CVSS 5.4) bypasses standard encryption separation between wireless endpoints, enabling data manipulation on affected networks. No patch is currently available.
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attacks against an administrative user of the interface. [CVSS 5.5 MEDIUM]
An Orchestrator service allows unauthenticated attackers to bypass MFA and create admin accounts without multi-factor authentication. This undermines the security of the entire authentication system.
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. [CVSS 7.2 HIGH]
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. [CVSS 7.2 HIGH]
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. [CVSS 7.2 HIGH]
Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer size values, the process may attempt to read beyond the intended memory region. [CVSS 5.3 MEDIUM]
Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer size values, the process may attempt to read beyond the intended memory region. [CVSS 5.3 MEDIUM]
An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating systems. [CVSS 6.5 MEDIUM]
A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations. [CVSS 6.5 MEDIUM]
Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. [CVSS 7.2 HIGH]
Arubaos contains a vulnerability that allows attackers to an authenticated malicious actor to create or modify arbitrary files and execute (CVSS 7.2).
An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. [CVSS 7.2 HIGH]
Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. [CVSS 7.2 HIGH]
Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. [CVSS 7.2 HIGH]
Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. [CVSS 7.2 HIGH]
A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allow an authenticated malicious actor to execute arbitrary code as a privileged user on the underlying operating system. [CVSS 7.2 HIGH]
Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. [CVSS 8.2 HIGH]
Command injection in the ArubaOS command line interface allows an authenticated remote attacker with low-privileged credentials to execute arbitrary commands on the underlying operating system, yielding full compromise of confidentiality, integrity, and availability on the affected device. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires both network reachability to the management CLI and a valid low-privilege account - an unauthenticated attacker cannot exploit it. At time of analysis, no public exploit identified and EPSS is low at 0.10% (28th percentile), with no CISA KEV listing, so this is a credible operational priority for organizations running Aruba/HPE wireless infrastructure rather than an emergency.
A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authenticated command injection in the command-line interface binary of HPE Aruba Networking AOS-10 Gateways and AOS-8 Controllers/Mobility Conductors lets an attacker who already holds high-privilege CLI credentials and has physical access to the appliance hardware escape the restricted CLI and execute arbitrary commands as a privileged user on the underlying operating system. The flaw carries a CVSS v3.1 score of 6.2 (CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so although confidentiality, integrity and availability impact is rated High, the vector is gated by two strong preconditions - physical access to the controller hardware (AV:P) and high-privilege authenticated access to the CLI (PR:H) - keeping real-world risk low. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is only 0.66% (50th percentile), consistent with a vulnerability that cannot be reached remotely.
Multiple vulnerabilities exist in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interface. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrary commands on the underlying host. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.
A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensitive information. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauthorized access to data and the ability to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote Attacker to conduct a stored cross-site scripting (XSS) attack. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote threat actor to conduct a remote code execution attack. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated remote denial-of-service in HPE Networking EdgeConnect SD-WAN Gateways (formerly Silver Peak), affecting firmware branches 9.4.x up to 9.4.8.2, 9.5.x up to 9.5.8.1, 9.6.x up to 9.6.3.1, and 9.7.0.0. An attacker who can reach the vulnerable gateway service can exhaust resources (CWE-400, uncontrolled resource consumption), rendering certain services on the appliance unavailable and disrupting SD-WAN connectivity for sites behind the gateway. The CVSS 3.1 score is 7.0 (AV:N/AC:H/PR:N/UI:N), and no public exploit code or CISA KEV listing was identified at time of analysis.
Adjacent-network attackers can crash HPE Networking EdgeConnect SD-WAN Gateways or leak small amounts of uninitialized stack memory by sending crafted traffic to the gateway, affecting unauthenticated devices reachable from the same Layer 2 segment. The flaw (CWE-200) carries a 7.1 CVSS score with the availability impact rated High and confidentiality impact Low, and it spans four maintained release trains from 9.4.0.0 through 9.7.0.0. It is not listed in CISA KEV, no public exploit code was identified in the supplied intelligence, and no EPSS probability was provided, so the immediate risk is driven by network adjacency and gateway exposure rather than confirmed mass exploitation.
A buffer overflow in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways allows an attacker who already holds high-privilege API credentials to execute arbitrary commands as a privileged operating-system user on the gateway appliance. Affected releases span the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches, per ENISA EUVD version ranges. The CVSS 3.1 vector requires PR:H, meaning exploitation is not unauthenticated; no public exploit was identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated attackers holding administrative access to the management plane of HPE Networking EdgeConnect SD-WAN Gateways can supply crafted input to an affected component and achieve arbitrary command execution as root. The flaw affects multiple released trains — 9.4.x up to 9.4.8.2, 9.5.x up to 9.5.8.1, 9.6.x up to 9.6.3.1, and 9.7.0.0 — with a CVSS base score of 7.2 reflecting the high privilege prerequisite against total loss of confidentiality, integrity, and availability. There is no CISA KEV entry, no EPSS score, and no public exploit code identified at time of analysis, so this is currently a high-impact but credential-gated risk rather than an actively exploited one.
Authenticated attackers who already hold administrative privileges on HPE Aruba EdgeConnect SD-WAN Gateways can supply specially crafted configuration data that overflows a stack buffer in the configuration processing logic, potentially yielding remote code execution as root or crashing the gateway into a denial of service. The flaw affects gateway releases in the 9.4.x (≤9.4.8.2), 9.5.x (≤9.5.8.1), 9.6.x (≤9.6.3.1) and 9.7.0.0 branches per the ENISA EUVD affected-version list, and carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No public exploit code, CISA KEV listing or EPSS score was included in the supplied intelligence, so the observed exploitation status is unconfirmed at time of analysis.
Authentication controls protecting the web-based management interface of HPE Aruba EdgeConnect SD-WAN Orchestrator can reportedly be circumvented by a remote actor, allowing escalation to administrative privileges and full compromise of the orchestrator host that manages the SD-WAN fabric. Reported affected releases span EdgeConnect SD-WAN software 9.4.0 through 9.7.0, with no fix version disclosed in the supplied source data. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so exploitation status is best treated as unconfirmed.
Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API lets an attacker who already holds a low-privilege account elevate to root and run arbitrary operating-system commands on the appliance. The flaw is remotely reachable (AV:N) but requires authentication plus a high-complexity exploitation path per the assigned CVSS vector (7.5, AC:H, PR:L). No public exploit code or CISA KEV entry was present in the supplied intelligence, so this is currently a post-authentication hardening priority rather than an actively exploited zero-day.
Unauthenticated remote denial-of-service in HPE Networking EdgeConnect SD-WAN Gateways, where a flaw in the appliance's underlying operating system lets a network-reachable attacker crash or stall an affected service. All four maintained branches are impacted — 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0 — with CVSS 7.5 reflecting a high availability impact and no confidentiality or integrity loss. No public exploit code and no CISA KEV listing were present in the source data at time of analysis, so this is currently a patch-now availability risk rather than a confirmed active campaign.
Unauthenticated remote code execution and denial-of-service in HPE Aruba Networking EdgeConnect SD-WAN Gateways (versions 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1, and 9.7.0.0) arise from flawed parsing of malformed or truncated packets in the proxy packet-processing path, where incorrect length arithmetic triggers an integer overflow that can become a memory-corruption (buffer overflow) condition. Successful exploitation can let a network-positioned attacker execute code or crash the gateway, taking down the SD-WAN overlay. The HPE advisory at support.hpe.com confirms affected version ranges, but there is no CISA KEV listing, no EPSS score, and no public exploit code identified at time of analysis, so this is currently a patch-now, watch-for-exploitation item rather than a confirmed active campaign.
Unauthenticated remote attackers can circumvent the authentication controls exposed by the API of HPE Networking EdgeConnect SD-WAN Orchestrator, escalating to administrative privileges and achieving complete compromise of the orchestrator host. The vendor rates this 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), and EUVD maps the affected code lines to EdgeConnect SD-WAN releases 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0. No CISA KEV listing or public exploit code was identified in the supplied intelligence, and EPSS data was not provided, so the practical exploitation risk rests on the high attack complexity (AC:H) noted in the vendor vector.
A buffer overflow in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways allows an unauthenticated remote attacker to execute arbitrary commands on the underlying host, resulting in full operating-system compromise of the appliance. Multiple maintenance trains are affected — 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and the 9.7.0.0 release. The vendor's own CVSS rating is 8.1 (AV:N/AC:H/PR:N/UI:N), reflecting that exploitation is unauthenticated but gated by preconditions outside the attacker's control; no public exploit code or CISA KEV listing was identified at time of analysis.
A limited buffer overflow in the network security monitoring component of HPE EdgeConnect SD-WAN Gateways allows an unauthenticated remote attacker to crash the appliance and potentially execute code by driving crafted traffic into the monitoring parser. ENISA EUVD lists four affected release trains: 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0. No CISA KEV entry and no public exploit code were identified at time of analysis, and no EPSS data was supplied with the record.
Incorrect authorization in the EdgeConnect SD-WAN Orchestrator API lets an authenticated remote user with low privileges retrieve sensitive information beyond what their role permits, and that data can potentially be leveraged to reach the SD-WAN network services the orchestrator manages. The vendor HPE/Aruba rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), and ENISA EUVD lists affected EdgeConnect SD-WAN Gateway releases in the 9.4.x, 9.5.x, 9.6.x and 9.7.0 lines. No public exploit code exists and the issue is not in CISA KEV at time of analysis; exploitation requires valid low-privilege credentials, which materially narrows the attacker population.
Server-side request forgery in the EdgeConnect SD-WAN Orchestrator API lets any remote user who already holds valid low-privilege credentials redirect server-side fetches to attacker-chosen internal destinations, mapping the internal structure of the Orchestrator host and disclosing sensitive information beyond that user's authorized privilege level. The issue is network-reachable at low attack complexity with no user interaction (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 8.5), and the scope change reflects the pivot out of the API context into the host/network fabric. No public exploit code was identified at time of analysis and no CISA KEV entry is associated with this CVE; note that the description names the Orchestrator while the ENISA EUVD record lists EdgeConnect SD-WAN Gateway builds 9.4.0 through 9.7.0, so the exact affected component should be confirmed against the HPE advisory before scoping exposure.
Unauthenticated attackers positioned on an adjacent network segment can crash HPE Networking EdgeConnect SD-WAN Gateway appliances by sending crafted traffic, causing a denial of service that the device cannot recover from without manual intervention. All four maintained firmware branches are affected: 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0. The vendor rates this 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) and the only publicly indexed advisory is HPE's own security bulletin (hpesbnw05135en_us); no CISA KEV listing, EPSS score, or public proof-of-concept code was present in the supplied intelligence, so active exploitation is unconfirmed.
Low-privilege authenticated attackers can escalate to root on HPE Networking EdgeConnect SD-WAN Gateways by abusing an API endpoint, gaining the ability to run arbitrary operating-system commands. The flaw carries a CVSS base score of 8.8 (AV:N/AC:L/PR:L/UI:N), meaning the attacker needs only valid low-privileged credentials and network reachability to the management API — no user interaction is required. Affected branches span EdgeConnect SD-WAN Gateways 9.4.x through 9.7.0.0; no public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis.
Privilege escalation in the EdgeConnect SD-WAN Gateway API lets a remote, authenticated low-privileged user gain administrative rights on the web-management interface, resulting in complete compromise of the gateway (CVSS 8.8, AV:N/PR:L). Affected branches are 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1, and 9.7.0.0. No public exploit code, EPSS score, or CISA KEV listing was provided at time of analysis; exploitation requires a valid low-privileged account and reachability of the management API.
A buffer overflow in the underlying operating system of HPE Aruba Networking EdgeConnect SD-WAN Gateways lets an unauthenticated attacker on an adjacent network segment execute arbitrary code as a privileged OS user, resulting in full compromise of the appliance. Affected branches span the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 release trains (up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively). The vendor describes exploitation as conditional on preconditions outside the attacker's control, and no public exploit code, EPSS score or CISA KEV entry was present in the supplied intelligence at time of analysis.
Authenticated command injection in the command-line interface of HPE Aruba EdgeConnect SD-WAN Gateways allows an attacker who already holds high-privileged CLI credentials to break out of the appliance shell and execute arbitrary commands on the underlying operating system, resulting in complete compromise of the gateway. The flaw affects the 9.4.x, 9.5.x, 9.6.x and 9.7.x maintenance streams (9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1 and 9.7.0.0) and carries a vendor-assigned CVSS of 9.1 with a scope change from the CLI component to the host OS. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so the practical priority is driven by exposure of the management CLI rather than by evidence of active exploitation.
Unauthenticated remote code execution affects HPE Networking EdgeConnect SD-WAN Gateways running firmware in the 9.4.x, 9.5.x, 9.6.x, and 9.7.0.0 branches, where a buffer overflow in an underlying operating system service permits a network-reachable attacker to run arbitrary commands and fully compromise the appliance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) and the independent assessment agree that no credentials or user interaction are needed, so the practical limiting factor is whether the vulnerable interface is reachable from an untrusted network. No public exploit code has been identified at time of analysis and the issue has not been confirmed actively exploited (CISA KEV), but the severity, the network-edge placement of these devices, and the credential-free attack path make this a top-priority patch item for exposed gateways.
Unauthenticated remote attackers can bypass authentication controls in the EdgeConnect SD-WAN Orchestrator management API to gain administrative privileges and fully compromise the underlying host, rated 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Affected builds per the EUVD advisory span EdgeConnect SD-WAN 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0, although the description attributes the flaw to the Orchestrator while EUVD lists Gateways, so the exact affected component should be confirmed against HPE advisory hpesbnw05135en_us. No public exploit identified at time of analysis and no CISA KEV entry, but the unauthenticated, network-reachable attack path and total confidentiality, integrity, and availability impact make this a top-priority exposure wherever the management API is internet-facing.
Information disclosure in the HPE Aruba EdgeConnect SD-WAN Orchestrator allows a remote attacker holding only a valid read-only account to retrieve sensitive configuration data, including third-party API tokens and credentials, by sending a specially crafted request to the cache synchronization endpoint. The vendor-supplied score of 9.9 reflects a scope-changed vector with high confidentiality and integrity impact, whereas independent reassessment places the realistic impact at confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), because the flaw leaks data rather than altering system state. No CISA KEV entry and no public exploit code were identified at time of analysis, so the practical risk scales with how broadly low-privilege accounts are provisioned and whether the Orchestrator management interface is reachable from untrusted networks.
Privilege escalation in HPE Networking EdgeConnect SD-WAN Orchestrator (builds 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0) allows an authenticated, low-privileged user of the Orchestrator API to elevate themselves to an administrative role and take full control of the SD-WAN management plane. The issue is network-reachable, low complexity, and needs no user interaction (CVSS 3.1 AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact), but it is not exploitable before authentication, so the realistic attack surface is limited to deployments that hand out Orchestrator accounts - multi-tenant, self-service, or otherwise heavily populated role models, and far less so to single-admin environments. No public exploit code has been identified at time of analysis and the issue is not listed as actively exploited (no CISA KEV entry); the vendor rates it 9.9 with a scope change, while our independent assessment agrees on the impact metrics but scores it without a scope change.
Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API allows a remote, low-privileged but authenticated user to raise their permissions to administrative level, resulting in complete compromise of the management plane. Only holders of a valid low-privilege API account with network reachability to the API can trigger it (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), so the practical risk depends on how API accounts are provisioned and whether the management interface is segmented away from untrusted networks. Our assessment scores the issue as scope-unchanged (S:U) rather than the 9.9 / S:C vendor figure, which makes this a genuine high-priority issue rather than a CVSS-inflated one; no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV. Note that the affected version data names EdgeConnect SD-WAN Gateways while the description names the Orchestrator, so the exact affected component should be confirmed against the HPE advisory.
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unauthenticated memory disclosure in HPE Networking EdgeConnect SD-WAN Gateways lets an attacker on an adjacent network segment read portions of system memory, exposing internal service details and workflow information. All shipping 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches are affected per the vendor-published version ranges. The CVSS score is only 4.3 (confidentiality-only, adjacent vector) and there is no public exploit code or CISA KEV listing, so this is best treated as a reconnaissance enabler rather than a standalone compromise — its value to an adversary is in chaining it with a separate privilege-escalation or authentication flaw.
Unauthenticated remote attackers can query an API endpoint in HPE Networking EdgeConnect SD-WAN Orchestrator and read security-relevant configuration details and security feature status. The flaw is a CWE-200 information exposure rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, with only a low confidentiality impact and no integrity or availability impact), so it does not by itself compromise the platform but hands an adversary reconnaissance material that directly enables follow-on attacks against the managed SD-WAN fabric. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Authenticated attackers holding Admin privileges on HPE Networking EdgeConnect SD-WAN Gateways can send a crafted request to an API endpoint and trigger a classic buffer overflow (CWE-120), potentially achieving arbitrary command execution on the appliance's underlying operating system. ENISA EUVD lists affected builds across the 9.4.x, 9.5.x, 9.6.x and 9.7.x release branches, with the HPE advisory as the sole authoritative reference. No public exploit code and no CISA KEV entry were reported at time of analysis, and the vendor's 5.5 CVSS score omits any confidentiality impact despite the description claiming full OS-level command execution.
Authenticated administrators of the HPE (Aruba) EdgeConnect SD-WAN Orchestrator web management interface can be tricked into running attacker-supplied script in their own browser session, exposing data handled by the management plane. The flaw is a cross-site scripting (CWE-79) issue rated CVSS 5.5 with a scope change (S:C), meaning the injected code runs in the victim's browser context rather than inside the orchestrator process itself. There is no public exploit identified at time of analysis and the issue does not appear on CISA KEV, but exploitation requires an already-authenticated account, so the practical risk depends heavily on how many privileged accounts exist and how well the UI is network-restricted.
A buffer overflow in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways allows an authenticated administrator to crash or destabilize the appliance, producing a denial-of-service condition. All maintenance branches 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0 are affected per ENISA EUVD tracking. The CVSS base of 5.5 with PR:H reflects that high administrative privileges are required, so this is not an unauthenticated remote outage; no public exploit code or CISA KEV listing was identified at time of analysis.
Denial of service in HPE Networking EdgeConnect SD-WAN Gateways lets an authenticated local attacker with low privileges destabilize the appliance operating system and disrupt traffic forwarding. Affected builds span the 9.4.x, 9.5.x, 9.6.x and 9.7.x branches — up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively — and the trigger is both local-only and high-complexity, which keeps the CVSS score at 5.8 despite the High availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, so the practical priority is patch hygiene on devices where local or delegated accounts exist.
The API endpoint exposed by HPE Networking EdgeConnect SD-WAN Gateways can be queried by an unauthenticated remote attacker in a way that returns sensitive information, with successful exploitation yielding data that could be reused to reach other network services. Affected firmware spans the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches, and exploitation is rated high complexity (AC:H) even though no authentication is required. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so this is currently a targeted-risk disclosure bug rather than a mass-exploitation event.
Unauthenticated remote denial-of-service in HPE Networking EdgeConnect SD-WAN Gateways lets an attacker who can reach the appliance's exposed services interrupt normal operation and take the gateway's services offline, disrupting WAN connectivity for dependent sites. Affected branches are 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1 and 9.7.0.0, reported by HPE's own security-alert address. CVSS is 5.9 with a high attack-complexity qualifier and availability-only impact, and no public exploit code or confirmed active exploitation was identified at time of analysis.
A buffer overflow in a system service of the underlying operating system on HPE Networking EdgeConnect SD-WAN Gateways allows an unauthenticated attacker who already sits on an adjacent network segment to crash the affected service, temporarily disrupting SD-WAN and branch network operations. All editions of the 9.4.x (up to 9.4.8.2), 9.5.x (up to 9.5.8.1), 9.6.x (up to 9.6.3.1) and 9.7.0.0 releases are listed as affected by the vendor. The impact is degraded availability rather than confidentiality or code execution, exploitation requires high attack complexity, and no public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated command injection in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways (9.4.x, 9.5.x, 9.6.x and 9.7.0.0) lets a remote user who already holds limited access privileges submit specially crafted input that is passed to the underlying operating system, resulting in arbitrary command execution with elevated privileges or a denial-of-service condition on the appliance. The vendor-assigned CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) frames this as an availability-weighted, post-authentication issue rather than a pre-auth compromise. No CISA KEV listing, EPSS score or public proof-of-concept was supplied, so exploitation status is 'no public exploit identified at time of analysis'.
EdgeConnect SD-WAN Gateways expose sensitive information to any user who can authenticate to the web-based management interface with low privileges, letting them read data that can be reused to reach other network services managed by the gateway. All four supported branches listed by ENISA (9.4.0.0-9.4.8.2, 9.5.0.0-9.5.8.1, 9.6.0.0-9.6.3.1, and 9.7.0.0) are affected, per HPE's advisory hpesbnw05135en_us. The flaw is rated 6.5 (network vector, low privileges, no user interaction, confidentiality-only impact); no public exploit code and no CISA KEV listing were identified at time of analysis, so exploitation currently depends on an attacker already holding valid low-privilege credentials and reachability to the management interface.
Unauthenticated denial of service in HPE Networking EdgeConnect SD-WAN Gateways allows an attacker who already sits on an adjacent network segment to crash the appliance, with the added consequence that the gateway cannot reboot itself and requires manual intervention to recover. Affected releases span the 9.4, 9.5, 9.6 and 9.7 maintenance trains (up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively) per the ENISA EUVD record. The flaw is rated CVSS 6.5 (AV:A/AC:L/PR:N/UI:N, availability-only impact) and no public exploit code has been identified at time of analysis; there is no CISA KEV listing.
A buffer overflow in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways lets an unauthenticated remote attacker send specially crafted packets to an affected service and corrupt its memory. Rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, CWE-120), successful exploitation degrades the integrity and availability of the gateway service without exposing confidential data. No CISA KEV listing and no public exploit code were identified in the supplied intelligence, and no EPSS score was provided, so exploitation is currently assessed as opportunistic rather than confirmed in the wild.
Privilege escalation in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways lets an authenticated, already high-privileged remote user exceed their assigned authorization level and execute arbitrary code on the appliance. Four release branches are affected: 9.4.0.0-9.4.8.2, 9.5.0.0-9.5.8.1, 9.6.0.0-9.6.3.1 and 9.7.0.0. The CVSS score of 6.6 understates the operational weight of the flaw because a compromised SD-WAN gateway sits on the control plane of the whole WAN fabric; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
ArubaOS access points are vulnerable to gateway impersonation attacks when clients connect via wired or wireless interfaces, allowing unauthenticated attackers to redirect network traffic into a man-in-the-middle position. An attacker can exploit address-based spoofing to intercept or modify data streams intended for the legitimate gateway, compromising the confidentiality of client communications. No patch is currently available.
Arubaos contains a vulnerability that allows attackers to bypass Layer 2 (L2) communication restrictions between clients and redirect traf (CVSS 4.3).
Arubaos contains a vulnerability that allows attackers to redirect intercepted traffic to facilitate machine-in-the-middle (MitM) attacks (CVSS 4.3).
Traffic interception in ArubaOS Wi-Fi networks allows adjacent attackers to bypass BSSID isolation controls and redirect victim traffic by exploiting port associations across multiple wireless networks. Successful attacks could enable eavesdropping, session hijacking, or denial of service without authentication or user interaction. No patch is currently available for this medium-severity vulnerability.
Malicious actors can install unauthorized Group Temporal Keys on ArubaOS wireless clients through a standardized roaming protocol vulnerability, enabling frame injection and network segmentation bypass. An attacker positioned on the local network could leverage this to intercept traffic, bypass client isolation, and compromise network integrity and confidentiality. No patch is currently available.
Improper cryptographic validation in ArubaOS Wi-Fi encryption allows adjacent network attackers to forge authenticated frames by spoofing the primary BSSID and inject tampered data to targeted clients without authentication. This medium-severity flaw (CVSS 5.4) bypasses standard encryption separation between wireless endpoints, enabling data manipulation on affected networks. No patch is currently available.
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attacks against an administrative user of the interface. [CVSS 5.5 MEDIUM]
An Orchestrator service allows unauthenticated attackers to bypass MFA and create admin accounts without multi-factor authentication. This undermines the security of the entire authentication system.
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. [CVSS 7.2 HIGH]
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. [CVSS 7.2 HIGH]
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. [CVSS 7.2 HIGH]
Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer size values, the process may attempt to read beyond the intended memory region. [CVSS 5.3 MEDIUM]
Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer size values, the process may attempt to read beyond the intended memory region. [CVSS 5.3 MEDIUM]
An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating systems. [CVSS 6.5 MEDIUM]
A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations. [CVSS 6.5 MEDIUM]
Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. [CVSS 7.2 HIGH]
Arubaos contains a vulnerability that allows attackers to an authenticated malicious actor to create or modify arbitrary files and execute (CVSS 7.2).
An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. [CVSS 7.2 HIGH]
Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. [CVSS 7.2 HIGH]
Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. [CVSS 7.2 HIGH]
Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. [CVSS 7.2 HIGH]
A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allow an authenticated malicious actor to execute arbitrary code as a privileged user on the underlying operating system. [CVSS 7.2 HIGH]
Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. [CVSS 8.2 HIGH]
Command injection in the ArubaOS command line interface allows an authenticated remote attacker with low-privileged credentials to execute arbitrary commands on the underlying operating system, yielding full compromise of confidentiality, integrity, and availability on the affected device. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires both network reachability to the management CLI and a valid low-privilege account - an unauthenticated attacker cannot exploit it. At time of analysis, no public exploit identified and EPSS is low at 0.10% (28th percentile), with no CISA KEV listing, so this is a credible operational priority for organizations running Aruba/HPE wireless infrastructure rather than an emergency.
A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authenticated command injection in the command-line interface binary of HPE Aruba Networking AOS-10 Gateways and AOS-8 Controllers/Mobility Conductors lets an attacker who already holds high-privilege CLI credentials and has physical access to the appliance hardware escape the restricted CLI and execute arbitrary commands as a privileged user on the underlying operating system. The flaw carries a CVSS v3.1 score of 6.2 (CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so although confidentiality, integrity and availability impact is rated High, the vector is gated by two strong preconditions - physical access to the controller hardware (AV:P) and high-privilege authenticated access to the CLI (PR:H) - keeping real-world risk low. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is only 0.66% (50th percentile), consistent with a vulnerability that cannot be reached remotely.
Multiple vulnerabilities exist in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interface. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrary commands on the underlying host. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.
A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensitive information. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauthorized access to data and the ability to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote Attacker to conduct a stored cross-site scripting (XSS) attack. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote threat actor to conduct a remote code execution attack. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.