VulnerabilityModified
CVE-2020-12142
The vulnerability requires administrative access and shell access to the EdgeConnect appliance.
MEDIUM 4.9EPSS 0.72%
Does this matter?
Lower severity and a low EPSS score (0.72%). Track it; it rarely justifies an emergency change on its own.
Description
1. IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The vulnerability requires administrative access and shell access to the EdgeConnect appliance. An admin user can access IPSec seed and nonce parameters using the CLI, REST APIs, and the Linux shell.
- CVSS 3.1
- 4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.72% probability · 52th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-668
- Affected
- silver-peak/unity edgeconnect for amazon web services · silver-peak/unity edgeconnect for azure · silver-peak/unity edgeconnect for google cloud platform · silver-peak/unity orchestrator · silver-peak/vx-500 firmware · silver-peak/vx-1000 firmware · silver-peak/vx-2000 firmware · silver-peak/vx-3000 firmware · silver-peak/vx-5000 firmware · silver-peak/vx-6000 firmware · silver-peak/vx-7000 firmware · silver-peak/vx-9000 firmware · silver-peak/vx-8000 firmware · silver-peak/nx-700 firmware · silver-peak/nx-1000 firmware · silver-peak/nx-2000 firmware · silver-peak/nx-3000 firmware · silver-peak/nx-5000 firmware · silver-peak/nx-6000 firmware · silver-peak/nx-7000 firmware · +4 more
- Source
- sirt@silver-peak.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.