Skip to content
OpenAdvisories
Medium WID-SEC-2026-0109 5 CVEs

Aruba EdgeConnect SD-WAN Orchestrator: Mehrere Schwachstellen

Published Jan 13, 2026 · Updated Jan 14, 2026 · Revision 2 · de-DE

Vendor: Aruba Product: EdgeConnect Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Aruba EdgeConnect SD-WAN Orchestrator ausnutzen, um beliebigen Programmcode auszuführen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren.

Product

Aruba EdgeConnect ist eine SD-WAN-Produktfamilie für Unternehmenskunden.

Vulnerabilities 5

  • Critical 9.8
    CVE-2025-37184

    Unauthenticated Bypass Allows Multi-Factor Authentication Circumvention

    A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Successful exploitation could allow an attacker to create an admin user account without the necessary mul…

    Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator
  • High 7.2
    CVE-2025-37181

    Authenticated SQL Injection in EdgeConnect SD-WAN Orchestrator Web-Based Management Interface

    Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the un…

    Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator
  • High 7.2
    CVE-2025-37182

    Authenticated SQL Injection in EdgeConnect SD-WAN Orchestrator Web-Based Management Interface

    Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the un…

    Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator
  • High 7.2
    CVE-2025-37183

    Authenticated SQL Injection in EdgeConnect SD-WAN Orchestrator Web-Based Management Interface

    Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the un…

    Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator
  • Medium 5.5
    CVE-2025-37185

    Authenticated Stored Cross-Site Scripting Vulnerabilities (XSS) in EdgeConnect SD-WAN Orchestrator Web Administration Interface

    Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attacks against an administrative user of the interface. A successful exploit …

    Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator

Revision history

  1. #2

    EUVD Nummern eingetragen CVE's berichtigt

  2. #1

    Initiale Fassung

References