Back to overview

CVE-2025-37184

CRITICAL
9.8
CVSS 3.1
Description
A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Successful exploitation could allow an attacker to create an admin user account without the necessary multi-factor authentication, thereby compromising the integrity of secured access to the system.

Metadata

CVE ID
CVE-2025-37184
State
PUBLISHED
Assigner
hpe
Reserved
2025-04-16 01:28 UTC
Published
2026-01-14 16:19 UTC
Last updated
2026-03-03 17:48 UTC
Primary CWE
CWE-287
CWE-287 Improper Authentication
Vendor / Product
Hewlett Packard Enterprise (HPE) / EdgeConnect SD-WAN Orchestrator
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator — 9.5.0 ≤ 9.6.0, 9.4.0 ≤ 9.4.4
Weakness (CWE)
CWESourceDescription
CWE-287 adp CWE-287 Improper Authentication
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References (1)
Back to overview