HPE Aruba Networking EdgeConnect OS Broken Access Control Vulnerability

A broken access control vulnerability has been identified in HPE Aruba Networking EdgeConnect OS (ECOS) running on SD-WAN Gateways. This vulnerability allows attackers to bypass firewall protections, potentially misrouting unauthorized traffic and disrupting services. Affected versions include EdgeConnect SD-WAN Release Streams 9.5.3.x and below, 9.4.3.x and below, as well as all versions of 9.2.x.x and older, which are out of maintenance.

Impact

Exploitation of this vulnerability could lead to unauthorized access to internal network resources by allowing traffic to bypass firewall controls.

Remediation

Users are advised to upgrade to HPE Aruba Networking EdgeConnect SD-WAN versions 9.5.4.1 or 9.4.4.2. For Orchestrator software, the version must be equal to or greater than the ECOS version running on the gateways.