The vulnerability in the EdgeConnect SD-WAN Orchestrator API permits a remote attacker authenticated with low privileges to conduct SSRF attacks. This enables the attacker to gather information about the internal host structure, potentially exposing sensitive data that should be inaccessible given the attacker's privilege level. The CVSS 3.1 base score is 8.5, indicating high severity with network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation allows an attacker to bypass privilege restrictions and enumerate internal host details, potentially leading to unauthorized disclosure of sensitive information. The confidentiality impact is high, while integrity and availability impacts are low or none.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict access to the API to trusted users and monitor for suspicious activity consistent with SSRF attempts.