CVE-2026-44879

A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on certain CLI commands. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05013en_us&docLocale=en_US

Configurations

No configuration.

History

24 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad en la interfaz de línea de comandos de los dispositivos ECOS podría permitir a un atacante remoto autenticado y altamente privilegiado realizar inyección de comandos en ciertos comandos de la CLI. La explotación exitosa podría permitir a un atacante ejecutar comandos arbitrarios en el sistema operativo subyacente.

Information

Published : 2026-07-21 21:16

Updated : 2026-10-24 19:10

NVD link : CVE-2026-44879

Mitre link : CVE-2026-44879

CVE.ORG link : CVE-2026-44879

JSON object : View

Products Affected

No product.

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2026-44879", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44879", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-23T13:31:05.643166Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-alert@hpe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-alert@hpe.com", "affectedData": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "EdgeConnect SD-WAN Gateway (ECOS)", "versions": [{"status": "affected", "version": "9.4.0.0", "versionType": "semver", "lessThanOrEqual": "9.4.4.0"}, {"status": "affected", "version": "9.5.0.0", "versionType": "semver", "lessThanOrEqual": "9.5.4.0"}], "defaultStatus": "affected"}]}], "published": "2026-07-21T21:16:49.750", "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05013en_us&docLocale=en_US", "source": "security-alert@hpe.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on certain CLI commands. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de l\u00ednea de comandos de los dispositivos ECOS podr\u00eda permitir a un atacante remoto autenticado y altamente privilegiado realizar inyecci\u00f3n de comandos en ciertos comandos de la CLI. La explotaci\u00f3n exitosa podr\u00eda permitir a un atacante ejecutar comandos arbitrarios en el sistema operativo subyacente."}], "lastModified": "2026-10-24T19:10:00.127", "sourceIdentifier": "security-alert@hpe.com"}