CVE-2020-12143: The certificate used to identify Orchestrator to EdgeConnect devices is not validated

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-05 · updated 2026-06-17
Weakness: CWE-295

Description

The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted Orchestrator.

Affected products

Silver-Peak Nx-1000 Firmware: all versions
Silver-Peak Nx-10K Firmware: all versions
Silver-Peak Nx-11K Firmware: all versions
Silver-Peak Nx-2000 Firmware: all versions
Silver-Peak Nx-3000 Firmware: all versions
Silver-Peak Nx-5000 Firmware: all versions
Silver-Peak Nx-6000 Firmware: all versions
Silver-Peak Nx-7000 Firmware: all versions
Silver-Peak Nx-700 Firmware: all versions
Silver-Peak Nx-8000 Firmware: all versions
Silver-Peak Nx-9000 Firmware: all versions
Silver-Peak Unity Edgeconnect For Amazon Web Services: all versions
Silver-Peak Unity Edgeconnect For Azure: all versions
Silver-Peak Unity Edgeconnect For Google Cloud Platform: all versions
Silver Peak Systems, Inc. Unity Orchestrator: before 8.9.2 — fixed in 8.9.2
Silver-Peak Vx-1000 Firmware: all versions
Silver-Peak Vx-2000 Firmware: all versions
Silver-Peak Vx-3000 Firmware: all versions
Silver-Peak Vx-5000 Firmware: all versions
Silver-Peak Vx-500 Firmware: all versions
Silver-Peak Vx-6000 Firmware: all versions
Silver-Peak Vx-7000 Firmware: all versions
Silver-Peak Vx-8000 Firmware: all versions
Silver-Peak Vx-9000 Firmware: all versions

How to fix

Upgrade to a fixed version: Silver Peak Systems, Inc. Unity Orchestrator 8.9.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-12143 or the next vulnerability affects your stack