What is the CVSS score of CVE-2020-12142?

CVE-2020-12142 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.7%.

Which versions of Unity Edgeconnect For Amazon Web Services are affected by CVE-2020-12142?

1. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Unity Edgeconnect For Amazon Web Services CVE-2020-12142

MEDIUM

Exposure of Resource to Wrong Sphere (CWE-668)

2020-05-05 sirt@silver-peak.com

Information Disclosure Unity Edgeconnect For Amazon Web Services Unity Edgeconnect For Azure Unity Edgeconnect For Google Cloud Platform Unity Orchestrator Vx 500 Firmware Vx 1000 Firmware Vx 2000 Firmware Vx 3000 Firmware Vx 5000 Firmware Vx 6000 Firmware Vx 7000 Firmware Vx 9000 Firmware Vx 8000 Firmware Nx 700 Firmware Nx 1000 Firmware Nx 2000 Firmware Nx 3000 Firmware Nx 5000 Firmware Nx 6000 Firmware Nx 7000 Firmware Nx 8000 Firmware Nx 9000 Firmware Nx 10K Firmware Nx 11K Firmware

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

May 05, 2020 - 20:15 nvd

MEDIUM 4.9

DescriptionNVD

IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The vulnerability requires administrative access and shell access to the EdgeConnect appliance. An admin user can access IPSec seed and nonce parameters using the CLI, REST APIs, and the Linux shell.

AnalysisAI

Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Exposure of Resource to Wrong Sphere (CWE-668), which allows attackers to access resources from an unintended security context. 1. IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The vulnerability requires administrative access and shell access to the EdgeConnect appliance. An admin user can access IPSec seed and nonce parameters using the CLI, REST APIs, and the Linux shell. Affected products include: Silver-Peak Unity Edgeconnect For Amazon Web Services, Silver-Peak Unity Edgeconnect For Azure, Silver-Peak Unity Edgeconnect For Google Cloud Platform, Silver-Peak Unity Orchestrator, Silver-Peak Vx-500 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement proper access controls, validate resource access permissions, use security boundaries.