CVE-2020-12143: The certificate used to identify Orchestrator to EdgeConnect devices is not validated
First published: Tue May 05 2020(Updated: )
The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted Orchestrator.
Credit: sirt@silver-peak.com sirt@silver-peak.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Silver-peak Unity Edgeconnect For Amazon Web Services | ||
| Silver-peak Unity Edgeconnect For Azure | ||
| Silver-peak Unity Edgeconnect For Google Cloud Platform | ||
| Silver-peak Unity Orchestrator | <8.9.2 | |
| Silver-peak Vx-500 Firmware | ||
| Silver-peak Vx-500 | ||
| Silver-peak Vx-1000 Firmware | ||
| Silver-peak Vx-1000 | ||
| Silver-peak Vx-2000 Firmware | ||
| Silver-peak Vx-2000 | ||
| Silver-peak Vx-3000 Firmware | ||
| Silver-peak Vx-3000 | ||
| Silver-peak Vx-5000 Firmware | ||
| Silver-peak Vx-5000 | ||
| Silver-peak Vx-6000 Firmware | ||
| Silver-peak Vx-6000 | ||
| Silver-peak Vx-7000 Firmware | ||
| Silver-peak Vx-7000 | ||
| Silver-peak Vx-9000 Firmware | ||
| Silver-peak Vx-9000 | ||
| Silver-peak Vx-8000 Firmware | ||
| Silver-peak Vx-8000 | ||
| Silver-peak Nx-700 Firmware | ||
| Silver-peak Nx-700 | ||
| Silver-peak Nx-1000 Firmware | ||
| Silver-peak Nx-1000 | ||
| Silver-peak Nx-2000 Firmware | ||
| Silver-peak Nx-2000 | ||
| Silver-peak Nx-3000 Firmware | ||
| Silver-peak Nx-3000 | ||
| Silver-peak Nx-5000 Firmware | ||
| Silver-peak Nx-5000 | ||
| Silver-peak Nx-6000 Firmware | ||
| Silver-peak Nx-6000 | ||
| Silver-peak Nx-7000 Firmware | ||
| Silver-peak Nx-7000 | ||
| Silver-peak Nx-8000 Firmware | ||
| Silver-peak Nx-8000 | ||
| Silver-peak Nx-9000 Firmware | ||
| Silver-peak Nx-9000 | ||
| Silver-peak Nx-10k Firmware | ||
| Silver-peak Nx-10k | ||
| Silver-peak Nx-11k Firmware | ||
| Silver-peak Nx-11k | ||
| Arubanetworks Vx-500 | ||
| Arubanetworks Vx-1000 | ||
| Arubanetworks Vx-2000 | ||
| Arubanetworks Vx-3000 | ||
| Arubanetworks Vx-5000 | ||
| Arubanetworks Vx-6000 | ||
| Arubanetworks Vx-7000 | ||
| Arubanetworks Vx-9000 | ||
| Arubanetworks Vx-8000 | ||
| Arubanetworks Nx-700 | ||
| Arubanetworks Nx-1000 | ||
| Arubanetworks Nx-2000 | ||
| Arubanetworks Nx-3000 | ||
| Arubanetworks Nx-5000 | ||
| Arubanetworks Nx-6000 | ||
| Arubanetworks Nx-7000 | ||
| Arubanetworks Nx-8000 | ||
| Arubanetworks Nx-9000 | ||
| Arubanetworks Nx-10k | ||
| Arubanetworks Nx-11k |
Remedy
Any required configuration • Do not change Orchestrator’s IP address as discovered by the EdgeConnect appliance. • Upgrade to Silver Peak Unity ECOS™ 8.3.2+ or 8.1.9.12+ and Silver Peak Unity Orchestrator™ 8.9.2+. • In Orchestrator, enable the “Verify Orchestrator Certificate” option under Advanced Security Settings. Solution link - References The full details of the CVE can be found at https://www.silver-peak.com/sites/default/files/advisory/security_advisory_notice_rogue_orchestrator_cve_2020_12143.pdf
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-12143?
CVE-2020-12143 is a vulnerability that allows for the establishment of a TLS connection from EdgeConnect to an untrusted Orchestrator due to the lack of certificate validation.
What software is affected by CVE-2020-12143?
Silver-peak Unity Edgeconnect for Amazon Web Services, Silver-peak Unity Edgeconnect for Azure, Silver-peak Unity Edgeconnect for Google Cloud Platform, Silver-peak Unity Orchestrator, and Silver-peak Vx-500 Firmware.
What is the severity of CVE-2020-12143?
CVE-2020-12143 has a severity rating of 4.9 (medium).
How does CVE-2020-12143 impact the system?
CVE-2020-12143 enables an attacker to establish a TLS connection from EdgeConnect to an untrusted Orchestrator.
How can I fix CVE-2020-12143?
To fix CVE-2020-12143, apply the necessary updates or patches provided by Silver-peak.
- collector/nvd-index
- collector/nvd-api
- agent/softwarecombine
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/remedy
- agent/references
- agent/last-modified-date
- agent/title
- agent/tags
- agent/type
- agent/first-publish-date
- agent/description
- agent/event
- vendor/silver-peak
- canonical/silver-peak unity edgeconnect for amazon web services
- canonical/silver-peak unity edgeconnect for azure
- canonical/silver-peak unity edgeconnect for google cloud platform
- canonical/silver-peak unity orchestrator
- canonical/silver-peak vx-500 firmware
- canonical/silver-peak vx-500
- canonical/silver-peak vx-1000 firmware
- canonical/silver-peak vx-1000
- canonical/silver-peak vx-2000 firmware
- canonical/silver-peak vx-2000
- canonical/silver-peak vx-3000 firmware
- canonical/silver-peak vx-3000
- canonical/silver-peak vx-5000 firmware
- canonical/silver-peak vx-5000
- canonical/silver-peak vx-6000 firmware
- canonical/silver-peak vx-6000
- canonical/silver-peak vx-7000 firmware
- canonical/silver-peak vx-7000
- canonical/silver-peak vx-9000 firmware
- canonical/silver-peak vx-9000
- canonical/silver-peak vx-8000 firmware
- canonical/silver-peak vx-8000
- canonical/silver-peak nx-700 firmware
- canonical/silver-peak nx-700
- canonical/silver-peak nx-1000 firmware
- canonical/silver-peak nx-1000
- canonical/silver-peak nx-2000 firmware
- canonical/silver-peak nx-2000
- canonical/silver-peak nx-3000 firmware
- canonical/silver-peak nx-3000
- canonical/silver-peak nx-5000 firmware
- canonical/silver-peak nx-5000
- canonical/silver-peak nx-6000 firmware
- canonical/silver-peak nx-6000
- canonical/silver-peak nx-7000 firmware
- canonical/silver-peak nx-7000
- canonical/silver-peak nx-8000 firmware
- canonical/silver-peak nx-8000
- canonical/silver-peak nx-9000 firmware
- canonical/silver-peak nx-9000
- canonical/silver-peak nx-10k firmware
- canonical/silver-peak nx-10k
- canonical/silver-peak nx-11k firmware
- canonical/silver-peak nx-11k
- vendor/arubanetworks
- canonical/arubanetworks vx-500
- canonical/arubanetworks vx-1000
- canonical/arubanetworks vx-2000
- canonical/arubanetworks vx-3000
- canonical/arubanetworks vx-5000
- canonical/arubanetworks vx-6000
- canonical/arubanetworks vx-7000
- canonical/arubanetworks vx-9000
- canonical/arubanetworks vx-8000
- canonical/arubanetworks nx-700
- canonical/arubanetworks nx-1000
- canonical/arubanetworks nx-2000
- canonical/arubanetworks nx-3000
- canonical/arubanetworks nx-5000
- canonical/arubanetworks nx-6000
- canonical/arubanetworks nx-7000
- canonical/arubanetworks nx-8000
- canonical/arubanetworks nx-9000
- canonical/arubanetworks nx-10k
- canonical/arubanetworks nx-11k