Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2025-37184

Unauthenticated Bypass Allows Multi-Factor Authentication Circumvention

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hpe

Description

A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Successful exploitation could allow an attacker to create an admin user account without the necessary multi-factor authentication, thereby compromising the integrity of secured access to the system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator

Default version status: affected

  • 9.5.0 to ≤ 9.6.0affected
  • 9.4.0 to ≤ 9.4.4affected

References