This vulnerability in the API endpoint of HPE EdgeConnect SD-WAN Orchestrator allows a low-privilege authenticated remote attacker to escalate privileges. Exploiting this flaw enables execution of arbitrary system commands with root privileges on the underlying OS. The affected versions are 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and exactly 9.7.0. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with low-privilege authenticated access can escalate privileges to root and execute arbitrary system commands on the affected HPE EdgeConnect SD-WAN Gateway devices. This compromises the confidentiality, integrity, and availability of the system, potentially allowing full control over the device and its operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor HPE advisories for updates. Until a fix is available, restrict access to the API endpoint to trusted users only and consider additional network-level controls to limit exposure.