PT-2026-2915 · Vmware · Edgeconnect Sd-Wan Orchestrator

M0X_Noob · Published 2026-01-13 · Updated 2026-01-14 · CVE-2025-37185

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EdgeConnect SD-WAN Orchestrator (affected versions not specified)

Description The web-based management interface of EdgeConnect SD-WAN Orchestrator contains a flaw that could allow an authenticated remote attacker to perform a stored cross-site scripting (XSS) attack against an administrative user. A successful exploit could enable an attacker to execute arbitrary script code within a victim’s browser, in the context of the affected interface. This could lead to unauthorized and arbitrary configuration changes to the host.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-00653

CVE-2025-37185

Affected Products

Edgeconnect Sd-Wan Orchestrator

References · 5

• https://bdu.fstec.ru/vul/2026-00653 · Security Note
• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04992en_us&docLocale=en_US · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-37185 · Security Note
• https://osv.dev/vulnerability/CVE-2025-37185 · Vendor Advisory
• https://twitter.com/CVEnew/status/2011555169788695026 · Twitter Post