A flaw in the API endpoint of HPE EdgeConnect SD‑WAN Gateways permits a low‑privilege authenticated attacker to inject arbitrary operating‑system commands. Once exploited the attacker can elevate privileges and execute commands with root authority. The result is unrestricted control over the underlying operating system, enabling full compromise of confidentiality, integrity, and availability of the device and the network it serves.

The affected vendor is Hewlett Packard Enterprise and the product is its EdgeConnect SD‑WAN Gateways. No edition or firmware version numbers are supplied in the public data, so organizations should verify that all deployed EdgeConnect units are assessed for this issue.

The CVSS score of 8.8 classifies the vulnerability as high severity. The EPSS score is < 1%, indicating a very low but nonzero chance of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the API with a low‑privilege account; however, the API is typically reachable from internal or managed control planes, making the attack vector explicitly remote, as stated in the vulnerability description. Successful exploitation results in root‑level code execution, meaning the risk remains severe even if the attack vector is constrained to logged‑in users.