CVE-2020-12142
The vulnerability requires administrative access and shell access to the EdgeConnect appliance.
Does this matter?
Lower severity and a low EPSS score (0.72%). Track it; it rarely justifies an emergency change on its own.
Description
1. IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The vulnerability requires administrative access and shell access to the EdgeConnect appliance. An admin user can access IPSec seed and nonce parameters using the CLI, REST APIs, and the Linux shell.
- CVSS 3.1
- 4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.72% probability · 54th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-668
- Affected
- silver-peak/unity edgeconnect for amazon web services · silver-peak/unity edgeconnect for azure · silver-peak/unity edgeconnect for google cloud platform · silver-peak/unity orchestrator · silver-peak/vx-500 firmware · silver-peak/vx-1000 firmware · silver-peak/vx-2000 firmware · silver-peak/vx-3000 firmware · silver-peak/vx-5000 firmware · silver-peak/vx-6000 firmware · silver-peak/vx-7000 firmware · silver-peak/vx-9000 firmware · silver-peak/vx-8000 firmware · silver-peak/nx-700 firmware · silver-peak/nx-1000 firmware · silver-peak/nx-2000 firmware · silver-peak/nx-3000 firmware · silver-peak/nx-5000 firmware · silver-peak/nx-6000 firmware · silver-peak/nx-7000 firmware · +4 more
- Source
- sirt@silver-peak.com
EPSS 0.7% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.