The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted Orchestrator.

Project Subscriptions

Vendors Products
Arubanetworks Subscribe
Silver-peak Subscribe
Nx-1000 Firmware Subscribe
Nx-10k Firmware Subscribe
Nx-11k Firmware Subscribe
Nx-2000 Firmware Subscribe
Nx-3000 Firmware Subscribe
Nx-5000 Firmware Subscribe
Nx-6000 Firmware Subscribe
Nx-7000 Firmware Subscribe
Nx-700 Firmware Subscribe
Nx-8000 Firmware Subscribe
Nx-9000 Firmware Subscribe
Unity Edgeconnect For Amazon Web Services Subscribe
Unity Edgeconnect For Azure Subscribe
Unity Edgeconnect For Google Cloud Platform Subscribe
Unity Orchestrator Subscribe
Vx-1000 Firmware Subscribe
Vx-2000 Firmware Subscribe
Vx-3000 Firmware Subscribe
Vx-5000 Firmware Subscribe
Vx-500 Firmware Subscribe
Vx-6000 Firmware Subscribe
Vx-7000 Firmware Subscribe
Vx-8000 Firmware Subscribe
Vx-9000 Firmware Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2020-4458 The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted Orchestrator.
Fixes

Solution

Any required configuration • Do not change Orchestrator’s IP address as discovered by the EdgeConnect appliance. • Upgrade to Silver Peak Unity ECOS™ 8.3.2+ or 8.1.9.12+ and Silver Peak Unity Orchestrator™ 8.9.2+. • In Orchestrator, enable the “Verify Orchestrator Certificate” option under Advanced Security Settings. Solution link - References The full details of the CVE can be found at https://www.silver-peak.com/sites/default/files/advisory/security_advisory_notice_rogue_orchestrator_cve_2020_12143.pdf


Workaround

No workaround given by the vendor.

History

Mon, 23 Feb 2026 17:15:00 +0000

Type Values Removed Values Added
Title The certificate used to identify Orchestrator to EdgeConnect devices is not validated The certificate used to identify Orchestrator to EdgeConnect devices is not validated

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Silver Peak

Published:

Updated: 2024-08-04T11:48:58.488Z

Reserved: 2020-04-24T00:00:00.000Z

Link: CVE-2020-12143

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-05-05T20:15:12.137

Modified: 2024-11-21T04:59:20.960

Link: CVE-2020-12143

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses