HPE Aruba Networking EdgeConnect SD-WAN Gateways Privilege Escalation Vulnerability

A vulnerability exists in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways. It allows authenticated remote attackers to escalate privileges, potentially enabling them to execute arbitrary system commands with root privileges on the underlying operating system. This issue affects HPE Aruba Networking EdgeConnect SD-WAN Release Streams 9.5.3.x and below, 9.4.3.x and below, as well as all versions of EdgeConnect OS 9.2.x.x and older, which are out of maintenance.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing attackers to execute arbitrary commands as root on the affected system.

Remediation

Users are advised to upgrade to HPE Aruba Networking EdgeConnect SD-WAN versions 9.5.4.1 or above, or 9.4.4.2 or above. For those using the EdgeConnect SD-WAN Orchestrator, ensure the software version is equal to or greater than the ECOS version running on the gateways.