This vulnerability affects the API of HPE EdgeConnect SD-WAN Orchestrator. An attacker authenticated with low privileges can exploit SSRF to gather information about the internal structure of the host system. This can lead to unauthorized disclosure of sensitive information beyond the attacker's existing privileges. The CVSS 3.1 base score is 8.5, indicating high severity, with network attack vector, low attack complexity, low privileges required, no user interaction, and impact including high confidentiality impact, low integrity impact, and no availability impact.

An attacker with low-privilege authentication can leverage SSRF to enumerate internal system details of the EdgeConnect SD-WAN Orchestrator host. This may lead to unauthorized disclosure of sensitive information beyond what the attacker is normally permitted to access, potentially aiding further attacks or reconnaissance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict access to the API to trusted users and monitor for suspicious activity consistent with SSRF exploitation attempts.