The vulnerability is a buffer overflow in the underlying operating system of EdgeConnect SD‑WAN gateways that can be triggered by an unauthenticated adjacent attacker when certain preconditions outside the attacker’s control are met. Successful exploitation can allow arbitrary code execution with privileged OS privileges, enabling the attacker to compromise the entire system.

The affected systems are Hewlett Packard Enterprise EdgeConnect SD‑WAN Gateways. No specific firmware or software version ranges are given; the advisory references HPE documentation for details.

The CVSS score of 8.8 classifies this vulnerability as high severity. The EPSS score is not available, and it is not listed in CISA’s KEV catalog, so the current public exploitation likelihood is uncertain. The attack vector requires proximity to the gateway; an attacker must be on the same network segment and meet unspecified preconditions. Successful exploitation would give the attacker full control of the gateway, potentially exposing all transported data and allowing lateral movement to downstream servers.