A flaw in the API endpoint of HPE EdgeConnect SD‑WAN Gateways permits a low‑privilege authenticated attacker to inject arbitrary operating‑system commands. Once exploited the attacker can elevate privileges and execute commands with root authority. The result is unrestricted control over the underlying operating system, enabling full compromise of confidentiality, integrity, and availability of the device and the network it serves.

The affected vendor is Hewlett Packard Enterprise and the product is its EdgeConnect SD‑WAN Gateways. No edition or firmware version numbers are supplied in the public data, so organizations should verify that all deployed EdgeConnect units are assessed for this issue.

The CVSS score of 8.8 classifies the vulnerability as high severity. EPSS data is not available, leaving the current exploitation probability unknown, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the API with a low‑privilege account; however, the API is typically reachable from internal or managed control planes, making the attack vector implicitly remote. Successful exploitation results in root-level code execution, meaning the risk is severe even if the attack vector is constrained to logged‑in users.