What’s Vulnerable › Vulnerabilities

CVE-2023-37426: Shared SSH Static Host Keys in EdgeConnect SD-WAN Orchestrator

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-08-22 · updated 2026-06-17
• Weakness: CWE-798

Description

EdgeConnect SD-WAN Orchestrator instances prior to the versions resolved in this advisory were found to have shared static SSH host keys for all installations. This vulnerability could allow an attacker to spoof the SSH host signature and thereby masquerade as a legitimate Orchestrator host.

Affected products

• Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator: from 9.0.0 through 9.0.5; from 9.1.0 through 9.1.7; from 9.2.0 through 9.2.5; 9.3.0

References

• https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt
• https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-012.txt

Get alerted when CVE-2023-37426 or the next vulnerability affects your stack