The flaw allows a network neighbor without authentication to read selectively exposed portions of the gateway's memory. By examining the memory contents, an attacker can gain insight into active services, configuration parameters, and workflow logic. This information loss could facilitate future attacks, such as credential reuse or privilege escalation, especially if combined with other known weaknesses. The vulnerability is a classic example of sensitive information exposure (CWE‑200).

The vulnerability targets Hewlett Packard Enterprise EdgeConnect SD‑WAN Gateways. Any gateway running firmware that has not been updated to the latest HPE release is susceptible. The advisory does not list specific firmware versions, so all installations remain potentially affected until an official patch is applied.

The CVSS score of 4.3 indicates a moderate confidentiality impact. Attackers need local adjacency to the gateway and do not require authentication, so the vector is network adjacent. An EPSS score of 0.00166, equivalent to less than 1%, indicates a very low but nonzero probability of exploitation. Since the CVE is not listed in the CISA KEV catalog, there is no record of active exploitation yet. Nevertheless, the exposure of memory contents can aid attackers in staging more severe attacks, so it should be treated with caution.