Description
A vulnerability exists in the configuration processing logic of the affected component where malformed input is improperly processed. An authenticated remote attacker with administrative privileges could exploit this vulnerability by providing specially crafted configuration data. Successful exploitation could result in a stack-based buffer overflow, potentially leading to remote code execution with root privileges or a denial of service due to a system crash.
Published: 2026-09-15
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution and Denial-of-Service
Action: Immediate Patch
AI Analysis

Impact

The flaw lies in configuration processing: malformed input is incorrectly handled, causing a stack-based buffer overflow. If an attacker with administrator rights submits specially crafted configuration data, the overflow may allow execution of arbitrary code with root privileges or trigger a system crash. The outcome is a loss of confidentiality and integrity of the gateway, and availability disruption if the device reboots.

Affected Systems

Hewlett Packard Enterprise EdgeConnect SD-WAN Gateways are affected. No specific firmware or software versions are listed in the advisory, so all current releases may be vulnerable until a patch is applied.

Risk and Exploitability

The CVSS score of 7.2 indicates a high severity vulnerability. The EPSS score is < 1%, indicating that the probability of exploitation is very low but not zero. The vulnerability is not listed in the CISA KEV catalog. Exploit requires authenticated remote access with administrative privileges, after which the attacker can feed malicious configuration data to trigger the stack overflow.

Generated by OpenCVE AI on September 17, 2026 at 06:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the HPE EdgeConnect firmware or software update that contains the buffer‑overflow fix.
  • Revoke or tightly audit administrative credentials to limit opportunities for compromised accounts to submit malicious configurations.
  • Configure network and application firewalls to block or rate‑limit configuration changes originating from untrusted sources.

Generated by OpenCVE AI on September 17, 2026 at 06:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Tue, 15 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description A vulnerability exists in the configuration processing logic of the affected component where malformed input is improperly processed. An authenticated remote attacker with administrative privileges could exploit this vulnerability by providing specially crafted configuration data. Successful exploitation could result in a stack-based buffer overflow, potentially leading to remote code execution with root privileges or a denial of service due to a system crash.
Title Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution or Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-09-15T19:23:48.495Z

Reserved: 2026-08-19T16:11:34.861Z

Link: CVE-2026-76689

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:17:50.930

Modified: 2026-09-16T19:20:52.817

Link: CVE-2026-76689

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T06:30:09Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer