This vulnerability involves an API endpoint in HPE Networking EdgeConnect SD-WAN Orchestrator that improperly exposes sensitive security configuration details to unauthenticated remote attackers. Exploitation does not require user interaction or privileges and results in information disclosure (CWE-200). The disclosed information includes security-relevant configuration and feature status, which could facilitate subsequent attacks. No known exploits are reported in the wild, and no patch or vendor advisory details are provided.

Successful exploitation leads to limited confidentiality impact by disclosing sensitive security configuration details and security feature status. There is no impact on integrity or availability. The disclosed information could be leveraged to support further targeted attacks against the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, restrict access to the affected API endpoint and monitor for unusual access patterns. Follow vendor updates closely for any forthcoming patches or mitigations.