CVE-2026-44878

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete system data.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05013en_us&docLocale=en_US

Configurations

No configuration.

History

24 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad en la interfaz de gestión basada en web de un dispositivo ECOS podría permitir a un atacante remoto autenticado y con altos privilegios acceder al sistema de archivos del dispositivo. La explotación exitosa de esta vulnerabilidad podría permitir a un atacante acceder a archivos sensibles y manipular o eliminar datos del sistema.

Information

Published : 2026-07-21 21:16

Updated : 2026-10-24 19:10

NVD link : CVE-2026-44878

Mitre link : CVE-2026-44878

CVE.ORG link : CVE-2026-44878

JSON object : View

Products Affected

No product.

CWE

CWE-377

Insecure Temporary File

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2026-44878", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44878", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-23T13:29:12.335150Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-alert@hpe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-alert@hpe.com", "affectedData": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "EdgeConnect SD-WAN Gateway (ECOS)", "versions": [{"status": "affected", "version": "9.4.0.0", "versionType": "semver", "lessThanOrEqual": "9.4.6.0"}, {"status": "affected", "version": "9.5.0.0", "versionType": "semver", "lessThanOrEqual": "9.5.6.0"}, {"status": "affected", "version": "9.6.0.0", "versionType": "semver", "lessThanOrEqual": "9.6.1.0"}], "defaultStatus": "affected"}]}], "published": "2026-07-21T21:16:49.640", "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05013en_us&docLocale=en_US", "source": "security-alert@hpe.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-377"}, {"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete system data."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de gesti\u00f3n basada en web de un dispositivo ECOS podr\u00eda permitir a un atacante remoto autenticado y con altos privilegios acceder al sistema de archivos del dispositivo. La explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda permitir a un atacante acceder a archivos sensibles y manipular o eliminar datos del sistema."}], "lastModified": "2026-10-24T19:10:00.127", "sourceIdentifier": "security-alert@hpe.com"}