## Summary
HPE Networking EdgeConnect SD-WAN Orchestrator contains an API vulnerability that could allow an unauthenticated remote actor to circumvent existing authentication controls. If exploited, an attacker may obtain administrative privileges and achieve complete compromise of the Orchestrator host.
## Technical Details
- Affected component: the API of HPE Networking EdgeConnect SD-WAN Orchestrator.
- The issue is described as enabling circumvention of existing authentication controls by a remote attacker.
- CVSS indicates network reachability with no user interaction required (AV:N, PR:N, UI:N) but requires some attacker capability (AC:H).
## Affected
- HPE Networking EdgeConnect SD-WAN Orchestrator (specific versions not provided in the supplied data).
## Impact
- Authentication bypass leading to privilege escalation to administrative level.
- Potential outcomes include:
- Confidentiality impact (C:H)
- Integrity impact (I:H)
- Availability impact (A:H)
- Scope is unchanged (S:U), but the result is full host compromise.
## Mitigation
1. Patch immediately: apply the vendor’s security update for this API authentication bypass (exact fixed versions not available in the provided material).
2. Restrict network exposure to the Orchestrator API (since the attack vector is NETWORK).
3. Monitor for suspicious API activity consistent with authentication control bypass attempts (no concrete detection indicators were provided in the supplied data).
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H