This vulnerability exists in the CLI of HPE EdgeConnect SD-WAN Gateway (ECOS) versions 9.4.0.0 and 9.5.0.0. A highly privileged, authenticated remote attacker can exploit command injection flaws in certain CLI commands to execute arbitrary commands on the underlying OS. The CVSS 3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability is published but no official fix or remediation level has been disclosed by HPE as of the provided data.

Successful exploitation could lead to full compromise of the affected device by allowing arbitrary command execution with high privileges. This impacts confidentiality, integrity, and availability of the device and potentially the network it manages. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the CLI interface to trusted administrators only and monitor for suspicious activity. Follow HPE's official advisories for updates on patches or mitigations.