What is the CVSS score of CVE-2020-12143?

CVE-2020-12143 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Unity Edgeconnect For Amazon Web Services CVE-2020-12143

MEDIUM

Improper Certificate Validation (CWE-295)

2020-05-05 sirt@silver-peak.com

Information Disclosure Unity Edgeconnect For Amazon Web Services Unity Edgeconnect For Azure Unity Edgeconnect For Google Cloud Platform Unity Orchestrator Vx 500 Firmware Vx 1000 Firmware Vx 2000 Firmware Vx 3000 Firmware Vx 5000 Firmware Vx 6000 Firmware Vx 7000 Firmware Vx 9000 Firmware Vx 8000 Firmware Nx 700 Firmware Nx 1000 Firmware Nx 2000 Firmware Nx 3000 Firmware Nx 5000 Firmware Nx 6000 Firmware Nx 7000 Firmware Nx 8000 Firmware Nx 9000 Firmware Nx 10K Firmware Nx 11K Firmware

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

May 05, 2020 - 20:15 nvd

MEDIUM 4.9

DescriptionNVD

The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted Orchestrator.

AnalysisAI

The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted Orchestrator. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-295. The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted Orchestrator. Affected products include: Silver-Peak Unity Edgeconnect For Amazon Web Services, Silver-Peak Unity Edgeconnect For Azure, Silver-Peak Unity Edgeconnect For Google Cloud Platform, Silver-Peak Unity Orchestrator, Silver-Peak Vx-500 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.