This vulnerability in HPE EdgeConnect SD-WAN Gateway (ECOS) affects the web-based management interface, permitting a highly privileged authenticated remote attacker to access the device filesystem. The attacker could read sensitive files and modify or delete system data. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Affected versions explicitly include 9.4.0.0, 9.5.0.0, and 9.6.0.0. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation allows a highly privileged authenticated remote attacker to access and manipulate the filesystem of the ECOS device. This can lead to disclosure of sensitive information, unauthorized modification, or deletion of critical system data, potentially disrupting device operation and network security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor HPE advisories for updates. Until a patch is available, restrict access to the web-based management interface to trusted administrators only and consider additional network-level protections to limit exposure.