A flaw in the protocol used by Hewlett Packard Enterprise EdgeConnect SD‑WAN Orchestrator allows an authenticated user with limited privileges to write arbitrary files and execute arbitrary system commands as the underlying operating system’s root user. The vulnerability satisfies CWE‑22 path traversal, CWE‑269 privileged escalation and CWE‑78 operating system command injection weaknesses. Successful exploitation can give the attacker full control over the host, compromising confidentiality, integrity, and availability of the affected system.

The impact applies to Hewlett Packard Enterprise EdgeConnect SD‑WAN Gateways, specifically the EdgeConnect SD‑WAN Orchestrator component. No specific version numbers are disclosed, so all current or future releases may be impacted until a remediation is installed.

The CVSS score of 7.5 indicates high severity, while the EPSS score of <1% suggests a low but non‑zero probability that the flaw will be exploited. Attackers need only a low‑privilege authenticated session to the orchestrator API, which enables privilege escalation to root on the underlying operating system. This threat is not listed in CISA KEV, yet the potential for remote code execution makes it a high‑risk vulnerability that can be leveraged by compromised user accounts or privileged API sessions.