CVE-2025-37184: critical vulnerability in Hewlett Packard Enterprise (HPE) EdgeConnect…
Unauthenticated Bypass Allows Multi-Factor Authentication Circumvention
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 0.6%
A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Successful exploitation could allow an attacker to create an admin user account without the necessary multi-factor authentication, thereby compromising the integrity of secured access to the system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Hewlett Packard Enterprise (HPE) · EdgeConnect SD-WAN OrchestratorRelated CVEs — Hewlett Packard Enterprise (HPE) EdgeConnect…
In the same product, most dangerous first.
CVE-2023-37427HIGHAuthenticated Remote Code Execution in EdgeConnect SD-WAN Orchestrator Web-Based Management InterfaceEPSS 1.3%CVE-2023-37428HIGHAuthenticated Remote Code Execution via Path Traversal in EdgeConnect SD-WAN Orchestrator Web-Based Management InterfaceEPSS 1.1%CVE-2023-37434MEDIUMAuthenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management InterfaceEPSS 1.0%CVE-2023-37424HIGHUnauthenticated Remote Code Execution in EdgeConnect SD-WAN Orchestrator Web-Based Management InterfaceEPSS 0.9%CVE-2026-63456CRITICALAuthentication bypass via spoofed HTTP headers Orchestrator REST APIEPSS 0.8%CVE-2026-63455CRITICALAuthentication bypass via spoofed HTTP headers Orchestrator REST APIEPSS 0.8%