CVE-2020-12142: IPSec UDP key material can be retrieved from EdgeConnect by a user with admin credentials
1. IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The vulnerability requires administrative access and shell access to the EdgeConnect appliance. An admin user can access IPSec seed and nonce parameters using the CLI, REST APIs, and the Linux shell.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2020-12142?
The severity of CVE-2020-12142 is medium, with a severity value of 4.9.
How can a user retrieve IPSec UDP key material from machine-to-machine interfaces and human-accessible interfaces?
A user with admin credentials and the required system knowledge can retrieve IPSec UDP key material from machine-to-machine interfaces and human-accessible interfaces.
What can an attacker do with the retrieved IPSec UDP key material in CVE-2020-12142?
An attacker with the IPSec UDP key material can decrypt in-flight communication.
Which Silver-peak products are affected by CVE-2020-12142?
Silver-peak Unity Edgeconnect for Amazon Web Services, Silver-peak Unity Edgeconnect for Azure, Silver-peak Unity Edgeconnect for Google Cloud Platform, Silver-peak Unity Orchestrator, and Silver-peak Vx-500 Firmware are affected by CVE-2020-12142.
How can I fix CVE-2020-12142?
There is currently no known fix for CVE-2020-12142. It is recommended to follow the recommendations provided by the vendor.