PT-2026-2915 · Vmware · Edgeconnect Sd-Wan Orchestrator

M0X_Noob · Publicado 2026-01-13 · Atualizado 2026-01-14 · CVE-2025-37185

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EdgeConnect SD-WAN Orchestrator (affected versions not specified)

Description The web-based management interface of EdgeConnect SD-WAN Orchestrator contains a flaw that could allow an authenticated remote attacker to perform a stored cross-site scripting (XSS) attack against an administrative user. A successful exploit could enable an attacker to execute arbitrary script code within a victim’s browser, in the context of the affected interface. This could lead to unauthorized and arbitrary configuration changes to the host.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2026-00653

CVE-2025-37185

Produtos afetados

Edgeconnect Sd-Wan Orchestrator

Referências · 5

• https://bdu.fstec.ru/vul/2026-00653 · Nota de Segurança
• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04992en_us&docLocale=en_US · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-37185 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-37185 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2011555169788695026 · Publicação no Twitter