The CVE describes a buffer overflow in the operating system underlying Hewlett Packard Enterprise EdgeConnect SD‑WAN Gateways. An unauthenticated adjacent attacker could trigger the overflow if certain preconditions outside the attacker’s control are met, leading to arbitrary code execution with privileged OS rights and complete system compromise.

The affected systems are Hewlett Packard Enterprise EdgeConnect SD‑WAN Gateways. No firmware or software version ranges were listed in the advisory; customers should refer to HPE’s documentation for specific details.

The CVSS score of 8.8 reflects high severity. The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating an uncertain likelihood of public exploitation. The attack vector likely requires adjacency to the gateway; this inference is drawn from the description’s mention of an "adjacent attacker" and is not explicitly detailed. Successful exploitation would grant the attacker full control of the gateway and its underlying operating system, potentially exposing all services run on the device.