The vulnerability allows an unauthenticated attacker who is adjacent to the network device to trigger a denial‑of‑service condition. By sending crafted traffic, the attacker can cause the EdgeConnect gateway to crash and lock itself, making it unresponsive until a manual reboot is performed. This effectively disrupts the flow of all network traffic that passes through the affected gateways. The weakness stems from insufficient input validation that permits resource exhaustion or state corruption, enabling the service to become non‑responsive.

Hewlett Packard Enterprise EdgeConnect SD‑WAN Gateways are impacted. Specific firmware or software versions are not provided in the advisory, so any deployment of these gateways should be verified against the vendor’s documentation for a patch or update that addresses the issue.

The CVSS score of 8.6 indicates a high severity with a large potential impact on availability. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, so the current exploitation probability is unknown but the exploitation path requires only local network adjacency and no authentication. The attack vector is inferred to be network‑adjacent, meaning that an attacker in the same LAN or VLAN could potentially trigger the exploit, making it a realistic local threat for unsecured environments.