CVEvulnerability
CVE-2020-12142
4.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-05-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N
- CVSS 3.1 ([email protected])
- 4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-668
Description
1. IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The vulnerability requires administrative access and shell access to the EdgeConnect appliance. An admin user can access IPSec seed and nonce parameters using the CLI, REST APIs, and the Linux shell.
Affected configurations
• silver-peak unity edgeconnect for amazon web services
• silver-peak unity edgeconnect for azure
• silver-peak unity edgeconnect for google cloud platform
• silver-peak unity orchestrator (< 8.9.2)
• silver-peak vx-500 firmware
• silver-peak vx-1000 firmware
• silver-peak vx-2000 firmware
• silver-peak vx-3000 firmware
• silver-peak vx-5000 firmware
• silver-peak vx-6000 firmware
• silver-peak vx-7000 firmware
• silver-peak vx-9000 firmware
• silver-peak vx-8000 firmware
• silver-peak nx-700 firmware
• silver-peak nx-1000 firmware
• silver-peak nx-2000 firmware
• silver-peak nx-3000 firmware
• silver-peak nx-5000 firmware
• silver-peak nx-6000 firmware
• silver-peak nx-7000 firmware
• silver-peak nx-8000 firmware
• silver-peak nx-9000 firmware
• silver-peak nx-10k firmware
• silver-peak nx-11k firmware
Related
Weakness · CWE (1)
- CWE-668 Exposure of Resource to Wrong Sphere weakness