This vulnerability involves buffer overflow conditions in the API endpoint of HPE EdgeConnect SD-WAN Gateways. Exploitation requires authentication and could allow remote attackers to execute arbitrary commands as privileged users on the underlying OS. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Affected versions include 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and exactly 9.7.0.0.

Successful exploitation could lead to arbitrary command execution with privileged access on the underlying operating system, potentially compromising confidentiality, integrity, and availability of the affected system. This could allow attackers to fully control the device and disrupt network operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no vendor advisory or patch information is provided, users should monitor official HPE communications for updates and apply patches or mitigations as soon as they become available.