This vulnerability exists in the configuration processing logic of HPE EdgeConnect SD-WAN Gateways. An authenticated attacker with administrative rights can supply specially crafted configuration data that triggers a stack-based buffer overflow. This overflow may allow execution of arbitrary code with root privileges or cause the system to crash, resulting in denial of service. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Affected versions span from 9.4.0.0 up to and including 9.7.0.0 in various subversions.

Successful exploitation can lead to remote code execution with root privileges, allowing full control over the affected system, or cause a denial of service through system crashes. This poses a significant risk to the confidentiality, integrity, and availability of the affected SD-WAN gateways.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted personnel only and monitor for suspicious configuration changes. Avoid applying untrusted configuration data. Follow vendor updates closely for patches or official mitigations.