This vulnerability involves a privilege escalation flaw in the CLI of HPE EdgeConnect SD-WAN Gateways. Successful exploitation requires an attacker to already have high-level authenticated access, after which they can gain elevated privileges and execute arbitrary code. The affected versions are 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and version 9.7.0.0. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

An attacker with authenticated high privileges can escalate their privileges beyond their authorized level and execute arbitrary code on the vulnerable system. This can lead to full compromise of the affected device, impacting confidentiality, integrity, and availability of the system and potentially the network it supports.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor HPE advisories for updates. Until a fix is available, restrict high-privilege access to trusted administrators only and consider additional access controls to limit exposure.