HPE Aruba Networking EdgeConnect SD-WAN Gateways Firewall Bypass Vulnerability

A vulnerability exists in HPE Aruba Networking EdgeConnect SD-WAN Gateways, specifically in versions 9.5.3.x and below on the 9.5.x.x release stream, as well as 9.4.3.x and below on the 9.4.x.x release stream. This vulnerability allows an unauthenticated remote attacker to bypass firewall protections, potentially misrouting harmful traffic through the internal network. This could lead to unauthorized access or disruption of services.

Impact

Exploitation of this vulnerability could allow an attacker to route harmful traffic into the internal network, bypassing firewall protections and potentially leading to unauthorized access or service disruption.

Remediation

Users are advised to upgrade to HPE Aruba Networking EdgeConnect SD-WAN versions 9.5.4.1 or 9.4.4.2. For Orchestrator software, the version must be greater than or equal to the ECOS version running on the gateways.