CVE-2020-12142— IPSec UDP key material can be retrieved from EdgeConnect by a user with admin credentials
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-12142
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
IPSec UDP key material can be retrieved from EdgeConnect by a user with admin credentials
Source: NVD (National Vulnerability Database)
Vulnerability Description
1. IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The vulnerability requires administrative access and shell access to the EdgeConnect appliance. An admin user can access IPSec seed and nonce parameters using the CLI, REST APIs, and the Linux shell.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
将资源暴露给错误范围
Source: NVD (National Vulnerability Database)
Vulnerability Title
多款Silver Peak Systems产品安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Silver Peak Systems Unity Orchestrator和Silver Peak Systems EdgeConnect Software（ECOS）都是美国Silver Peak Systems公司的产品。Silver Peak Systems Unity Orchestrator是一套云托管的多租户管理软件。该软件支持变更管理、故障排除和应用程序部署等功能。Silver Peak Systems EdgeConnect Software是一套软件定义的广义网络平台。该平台主要提供路
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Silver Peak Systems, Inc. | 1. Unity EdgeConnect, NX, VX 2. Unity Orchestrator, 3. EdgeConnect in AWS, Azure, GCP | All versions affected prior to Silver Peak Unity ECOS™ 8.3.2+, 8.1.9.12+ and Silver Peak Unity Orchestrator™ 8.9.2+ | - |
II. Public POCs for CVE-2020-12142
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-12142
请登录查看更多情报信息。
Same Patch Batch · Silver Peak Systems, Inc. · 2020-05-05 · 3 CVEs total
| CVE-2020-12143 | 6.0 MEDIUM | The certificate used to identify Orchestrator to EdgeConnect devices is not validated |
| CVE-2020-12144 | 6.0 MEDIUM | The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is no |
IV. Related Vulnerabilities
Same vendor: Silver Peak Systems, Inc.
- CVE-2020-12148
OS Command Injection - nslookup API - CVE-2020-12149
OS Command Injection - Management File Upload - CVE-2020-12146
Silver Peak Unity OrchestratorTM subject to path traversal. - CVE-2020-12147
Unauthorized queries against the Silver Peak Unity Orchestra - CVE-2020-12145
Silver Peak Unity OrchestratorTM authentication can be subve
Same weakness: CWE-668
- CVE-2026-41368
OpenClaw < 2026.3.28 - Environment Variable Disclosure via j - CVE-2026-41369
OpenClaw < 2026.3.31 - Insufficient Environment Variable San - CVE-2026-41362
OpenClaw 2026.2.19 < 2026.3.31 - Webhook Replay Dedupe Cache - CVE-2026-6830
Nesquena Hermes WebUI Environment Variable Credential Leakag - CVE-2026-32690
Apache Airflow: 3.x - Nested Variable Secret Values Bypass R
V. Comments for CVE-2020-12142
No comments yet