CVEvulnerability
CVE-2020-12143
4.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-05-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.0 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H
- CVSS 3.1 ([email protected])
- 4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-295
Description
The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted Orchestrator.
Affected configurations
• silver-peak unity edgeconnect for amazon web services
• silver-peak unity edgeconnect for azure
• silver-peak unity edgeconnect for google cloud platform
• silver-peak unity orchestrator (< 8.9.2)
• silver-peak vx-500 firmware
• silver-peak vx-1000 firmware
• silver-peak vx-2000 firmware
• silver-peak vx-3000 firmware
• silver-peak vx-5000 firmware
• silver-peak vx-6000 firmware
• silver-peak vx-7000 firmware
• silver-peak vx-9000 firmware
• silver-peak vx-8000 firmware
• silver-peak nx-700 firmware
• silver-peak nx-1000 firmware
• silver-peak nx-2000 firmware
• silver-peak nx-3000 firmware
• silver-peak nx-5000 firmware
• silver-peak nx-6000 firmware
• silver-peak nx-7000 firmware
• silver-peak nx-8000 firmware
• silver-peak nx-9000 firmware
• silver-peak nx-10k firmware
• silver-peak nx-11k firmware
Related
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness