Back to Database
Status published
Medium
CVE-2020-12143
The certificate used to identify Orchestrator to EdgeConnect devices is not validated
Vulnerability Description
The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted Orchestrator.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-12143
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- This vulnerability was reported to Silver Peak by Denis Kolegov, Mariya Nedyak, and Anton Nikolaev from the SD-WAN New Hop team.
More from Silver Peak Systems, Inc.
View All →CVE-2020-12149
OS Command Injection - Management File Upload
Medium
6.8
CVE-2020-12148
OS Command Injection - nslookup API
Medium
6.8
CVE-2020-12147
Unauthorized queries against the Silver Peak Unity OrchestratorTM MySQL database.
Medium
6.6
CVE-2020-12146
Silver Peak Unity OrchestratorTM subject to path traversal.
Medium
6.6
CVE-2020-12145
Silver Peak Unity OrchestratorTM authentication can be subverted through manipulation of HTTP headers.
Medium
6.6
Affected Vendor
Silver Peak Systems, Inc.
View all reports →Affected Software
1. Unity EdgeConnect, NX, VX 2. Unity Orchestrator, 3. EdgeConnect in AWS, Azure, GCP
Vulnerable Versions:
All versions affected prior to Silver Peak Unity ECOS™ 8.3.2+, 8.1.9.12+ and Silver Peak Unity Orchestrator™ 8.9.2+
Timeline
Official Publish:
May 5th, 2020
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H