medium4.8
CVE-2020-12142
1.
Impact
1. IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The vulnerability requires administrative access and shell access to the EdgeConnect appliance. An admin user can access IPSec seed and nonce parameters using the CLI, REST APIs, and the Linux shell.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Silver-Peak | Unity Edgeconnect For Amazon Web Services | All versions |
| Silver-Peak | Unity Edgeconnect For Azure | All versions |
| Silver-Peak | Unity Edgeconnect For Google Cloud Platform | All versions |
| Silver-Peak | Unity Orchestrator | before 8.9.2 |
| Silver-Peak | Vx-500 Firmware | All versions |
| Silver-Peak | Vx-1000 Firmware | All versions |
| Silver-Peak | Vx-2000 Firmware | All versions |
| Silver-Peak | Vx-3000 Firmware | All versions |
| Silver-Peak | Vx-5000 Firmware | All versions |
| Silver-Peak | Vx-6000 Firmware | All versions |
| Silver-Peak | Vx-7000 Firmware | All versions |
| Silver-Peak | Vx-9000 Firmware | All versions |