This vulnerability affects the API of EdgeConnect SD-WAN Orchestrator, permitting an authenticated attacker with limited privileges to retrieve sensitive information beyond their authorization. The flaw could be leveraged to escalate access or gain additional insight into network services supported by the orchestrator. The CVSS v3.1 score is 8.5, indicating high severity, with attack vector network, low attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, low integrity impact, and no availability impact.

An attacker with valid credentials but low privileges can access sensitive information not normally accessible to their privilege level. This unauthorized data exposure could be used to facilitate further attacks or unauthorized access within the network environment managed by EdgeConnect SD-WAN Orchestrator. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the API to trusted users and monitor for suspicious activity. Do not assume the vulnerability is mitigated without vendor confirmation.