A flaw in the API of Hewlett Packard Enterprise EdgeConnect SD‑WAN Gateways permits a low‑privilege, authenticated user to bypass normal authorization checks and obtain administrative control over the web‑management interface. This allows the attacker to read, modify and delete configuration settings, effectively taking full control of the device. The vulnerability is an example of a privilege escalation flaw (CWE‑269).

The affected product is Hewlett Packard Enterprise EdgeConnect SD‑WAN Gateways. No specific firmware or hardware revision numbers are disclosed, so the vulnerability applies to all deployed versions until a vendor‑issued fix is applied.

The CVSS score of 8.8 classifies the issue as high severity, while the EPSS score of less than 1% indicates an extremely low probability of exploitation at present. The vulnerability is not included in the CISA KEV catalog, suggesting no known widespread exploits. Based on the description, the attack vector is inferred to be remote via the EdgeConnect API; the attacker must first be authenticated with a low‑privileged account, then send specially crafted requests to elevate privileges. If system boundaries are exposed to untrusted networks, the realistic risk increases.