CVE-2020-12142

IPSec UDP key material can be retrieved from EdgeConnect by a user with admin credentials

Published May 5, 2020 CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
1. IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The vulnerability requires administrative access and shell access to the EdgeConnect appliance. An admin user can access IPSec seed and nonce parameters using the CLI, REST APIs, and the Linux shell.

Remediation

Vendor Solution

https://www.silver-peak.com/sites/default/files/advisory/security_advisory_notice_ipsec_udp_key_material_cve_2020_12142.pdf

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2020-4457 1. IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials. Such a user, with the required system knowledge, could use this material to decrypt in-flight communication. 2. The vulnerability requires administrative access and shell access to the EdgeConnect appliance. An admin user can access IPSec seed and nonce parameters using the CLI, REST APIs, and the Linux shell.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
Silver Peak
Published
Updated
Aug 4, 2024, 11:48 AM
Reserved
Apr 24, 2020, 12:00 AM
Status
Modified
Published
May 5, 2020, 8:15 PM
Modified
Jun 17, 2026, 2:51 AM