CVE-2024-22443

published 2024-07-24

CVE-2024-22443: A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a server-side…

Priority P2 61 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
arubanetworks	edgeconnect_sd-wan_orchestrator	>= 9.1.0 < 9.1.10	9.1.10
arubanetworks	edgeconnect_sd-wan_orchestrator	>= 9.2.0 < 9.2.10	9.2.10
arubanetworks	edgeconnect_sd-wan_orchestrator	>= 9.3.0 < 9.3.3	9.3.3
arubanetworks	edgeconnect_sd-wan_orchestrator	>= 9.4.0 < 9.4.2	9.4.2
hewlett_packard_enterprise	hpe_aruba_networking_edgeconnect_sd-wan_orchestrator	EdgeConnect SD-WAN Orchestrator 9.1.x: Orchestrator 9.1.9 (all builds) and below – <=9.1.9	—
hewlett_packard_enterprise	hpe_aruba_networking_edgeconnect_sd-wan_orchestrator	EdgeConnect SD-WAN Orchestrator 9.2.x: Orchestrator 9.2.9 (all builds) and below – <=9.2.9	—
hewlett_packard_enterprise	hpe_aruba_networking_edgeconnect_sd-wan_orchestrator	EdgeConnect SD-WAN Orchestrator 9.3.x: Orchestrator 9.3.2 (all builds) and below – <=9.3.2	—
hewlett_packard_enterprise	hpe_aruba_networking_edgeconnect_sd-wan_orchestrator	EdgeConnect SD-WAN Orchestrator 9.4.x: Orchestrator 9.4.1 (all builds) and below – <=9.4.1	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-1321