CVE-2025-37182

HIGH

EdgeConnect SD-WAN Orchestrator - Authenticated SQL Injection

Title source: llm

Description

Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized data access or data manipulation.

References (1)

Core 1

Core References

Vendor Advisory

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04992en_us&docLocale=en_US

Scores

CVSS v3 7.2

EPSS 0.0013

EPSS Percentile 32.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-89

Status published

Products (2)

arubanetworks/edgeconnect_sd-wan_orchestrator 9.6.0

arubanetworks/edgeconnect_sd-wan_orchestrator 9.2.0 - 9.2.10

Published Jan 14, 2026

Tracked Since Feb 18, 2026