This vulnerability exists in the SD-WAN Orchestrator component of HPE EdgeConnect SD-WAN Gateways. An attacker with read-only authenticated access can exploit the cache synchronization endpoint to obtain sensitive configuration data. The disclosed information includes third-party API tokens and credentials, which could be leveraged to move laterally within connected security platforms. The CVSS 3.1 base score is 9.9, indicating a critical severity with network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and low impact on availability.

Exploitation leads to disclosure of sensitive configuration information, including third-party API tokens and credentials. This exposure can enable attackers to perform lateral movement to external security platforms, potentially compromising additional systems and data. The vulnerability requires authenticated read-only access but has a critical impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is released, restrict read-only authenticated access to trusted users only and monitor for suspicious activity related to the cache synchronization endpoint.