Back to feed
EUVD-2020-4458 · Published May 5, 2020
The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted Orchestrator.
Technologies
Silver-Peak Vx-6000 FirmwareArubanetworks Nx-3000Arubanetworks Nx-5000Silver-Peak Unity Edgeconnect For AzureArubanetworks Nx-6000Silver-Peak Nx-9000 FirmwareSilver-Peak Nx-5000 FirmwareArubanetworks Vx-5000Arubanetworks Nx-8000Arubanetworks Vx-500Arubanetworks Vx-2000Arubanetworks Vx-6000Silver-Peak Vx-9000 FirmwareArubanetworks Vx-1000Silver-Peak Nx-7000 FirmwareSilver-Peak Vx-3000 FirmwareSilver-Peak Unity Edgeconnect For Google Cloud PlatformArubanetworks Nx-1000Arubanetworks Vx-7000Silver-Peak Nx-10K FirmwareSilver-Peak Unity OrchestratorArubanetworks Nx-11KSilver-Peak Nx-11K FirmwareArubanetworks Nx-9000Silver-Peak Vx-2000 FirmwareArubanetworks Nx-700Arubanetworks Vx-8000Silver-Peak Nx-2000 FirmwareArubanetworks Vx-3000Silver-Peak Vx-7000 FirmwareArubanetworks Vx-9000Silver-Peak Vx-8000 FirmwareSilver-Peak Nx-3000 FirmwareSilver-Peak Nx-6000 FirmwareSilver-Peak Vx-500 FirmwareSilver-Peak Nx-700 FirmwareArubanetworks Nx-10KSilver-Peak Nx-8000 FirmwareSilver-Peak Nx-1000 FirmwareSilver-Peak Unity Edgeconnect For Amazon Web ServicesArubanetworks Nx-2000Silver-Peak Vx-5000 FirmwareArubanetworks Nx-7000Silver-Peak Vx-1000 Firmware
Weaknesses
CWE-295
CVSS scores
- v3.14.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - v2.04.0
AV:N/AC:L/Au:S/C:N/I:P/A:N
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
Potentially impacted assets
See if this affects your attack surface
