CVE-2023-37428

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability in the EdgeConnect SD-WAN Orchestrator web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
Hewlett Packard Enterprise (HPE)EdgeConnect SD-WAN Orchestrator>= Orchestrator 9.3.x, <= <=9.3.0; >= Orchestrator 9.2.x, <= <=9.2.5; >= Orchestrator 9.1.x, <= <=9.1.7
hpeedgeconnect_sd-wan_orchestrator>= 9.1x, <= 9.1.7; >= 9.2x, <= 9.2.5; >= 9.3x, <= 9.3.0

References

Timeline

Published
Aug 22, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-374298.1Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attackCVE-2023-37437.5Ap Page Builder, in versions lower than 1.7.8.2, could allow a remote attacker to send a specially crafted SQL query to the product_one_img CVE-2023-374308.1Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attackCVE-2023-374318.1Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attackCVE-2023-374328.1Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attackCVE-2023-374338.1Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attackCVE-2023-374348.1Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attackCVE-2023-374356.5Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attackCVE-2023-374366.5Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attackCVE-2023-374376.5Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attackCVE-2023-374386.5Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attackCVE-2023-374396.1Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attack
CVE-2023-37428: High severity, CVSS 7.2 | Vulnix