CVE-2025-37129
BaseFortify
Publication date: 2025-09-16
Last updated on: 2025-09-17
Assigner: Hewlett Packard Enterprise (HPE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hpe | edgeconnect_sd-wan | 3.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the command line interface of EdgeConnect SD-WAN, where an authenticated attacker can exploit built-in script execution capabilities. If the feature is enabled without proper security measures, the attacker could execute arbitrary commands on the underlying operating system.
How can this vulnerability impact me? :
The vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system, potentially leading to full compromise of the affected system, including unauthorized access, data manipulation, or disruption of services.