What’s Vulnerable › Vulnerabilities
CVE-2020-12142: IPSec UDP key material can be retrieved from EdgeConnect by a user with admin credentials
- Severity: medium (CVSS 4.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-05-05 · updated 2026-06-17
- Weakness: CWE-668
Description
1. IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The vulnerability requires administrative access and shell access to the EdgeConnect appliance. An admin user can access IPSec seed and nonce parameters using the CLI, REST APIs, and the Linux shell.
Affected products
- Silver-Peak Nx-1000 Firmware: all versions
- Silver-Peak Nx-10K Firmware: all versions
- Silver-Peak Nx-11K Firmware: all versions
- Silver-Peak Nx-2000 Firmware: all versions
- Silver-Peak Nx-3000 Firmware: all versions
- Silver-Peak Nx-5000 Firmware: all versions
- Silver-Peak Nx-6000 Firmware: all versions
- Silver-Peak Nx-7000 Firmware: all versions
- Silver-Peak Nx-700 Firmware: all versions
- Silver-Peak Nx-8000 Firmware: all versions
- Silver-Peak Nx-9000 Firmware: all versions
- Silver-Peak Unity Edgeconnect For Amazon Web Services: all versions
- Silver-Peak Unity Edgeconnect For Azure: all versions
- Silver-Peak Unity Edgeconnect For Google Cloud Platform: all versions
- Silver Peak Systems, Inc. Unity Orchestrator: before 8.9.2 — fixed in 8.9.2
- Silver-Peak Vx-1000 Firmware: all versions
- Silver-Peak Vx-2000 Firmware: all versions
- Silver-Peak Vx-3000 Firmware: all versions
- Silver-Peak Vx-5000 Firmware: all versions
- Silver-Peak Vx-500 Firmware: all versions
- Silver-Peak Vx-6000 Firmware: all versions
- Silver-Peak Vx-7000 Firmware: all versions
- Silver-Peak Vx-8000 Firmware: all versions
- Silver-Peak Vx-9000 Firmware: all versions
How to fix
Upgrade to a fixed version: Silver Peak Systems, Inc. Unity Orchestrator 8.9.2. Check the vendor advisory for mitigations.
References
- https://www.silver-peak.com/sites/default/files/advisory/security_advisory_notice_ipsec_udp_key_material-cve_2020_12142.pdf
- https://www.silver-peak.com/sites/default/files/advisory/security_advisory_notice_ipsec_udp_key_material-cve_2020_12142.pdf
Get alerted when CVE-2020-12142 or the next vulnerability affects your stack