PT-2025-38089 · Vmware · Edgeconnect Sd-Wan

Ncc Group · Published 2025-09-16 · Updated 2025-09-17 · CVE-2025-37129

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EdgeConnect SD-WAN (affected versions not specified)

Description A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilities. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system if the feature is enabled without proper security measures.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-12606

CVE-2025-37129

Affected Products

Edgeconnect Sd-Wan

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-37129 · Security Note
• https://bdu.fstec.ru/vul/2025-12606 · Security Note
• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04943en_us&docLocale=en_US · Note
• https://twitter.com/VulmonFeeds/status/1968193552833274155 · Twitter Post
• https://t.me/CVEtracker/32697 · Telegram Post
• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04943en_us&docLocale=en_US · Note
• https://twitter.com/CVEnew/status/1968190762811592942 · Twitter Post