CVE-2020-12144

The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated

6.0 Medium

The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated. This makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted portal.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: High
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: High
Availability: High

Exploit likelihood

0.34%Down 0.1 points since Apr 14, 2021

What each source reports

CVE List Score used 6.0

The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated

Record: CVE-2020-12144
CVSS 3.1: 6.0 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H
Weakness: CWE-295
Updated: 2026-11-02

EUVDEUVD-2020-4459 6.0

Record: EUVD-2020-4459
CVSS 3.1: 6.0 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7qwj-rq2v-gm66 4.9

Details The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is...

Details The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated. This makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted portal. Product affected All versions affected prior to Silver Peak Unity ECOS™ 8.3.2+, 8.1.9.12+ and Silver Peak Unity Orchestrator™ 8.9.2+ Silver Peak Products Applicability Unity EdgeConnect, NX, VX Applicable Unity Orchestrator Applicable EdgeConnect in AWS, Azure, GCP Applicable Silver Peak Cloud Services Not Applicable Resolution • Changes have been made to strengthen the initial exchange between the EdgeConnect appliance and the Cloud Portal. After the changes, EdgeConnect will validate the certificate used to identify the Silver Peak Cloud Portal to EdgeConnect. • TLS itself is continually subject to newly discovered and exploitable vulnerabilities. As such, all versions of EdgeConnect software implement additional out-of-band and user-controlled authentication mechanisms. Any required configuration • Do not change Cloud Portal’s IP address as discovered by the EdgeConnect appliance. • Upgrade to Silver Peak Unity ECOS™ 8.3.2+ or 8.1.9.12+ and Silver Peak Unity Orchestrator™ 8.9.2+. • In Orchestrator, enable the “Verify Portal Certificate” option under Advanced Security Settings.

Record: GHSA-7qwj-rq2v-gm66
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-295
Updated: 2026-11-02

NVD 6.0

Record: CVE-2020-12144
CVSS 3.1: 6.0 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:N/I:P/A:N
Weakness: CWE-295
Updated: 2026-11-02

Affected products

Show 13 moreShow less

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-12144 is a medium vulnerability (CVSS 6.0) in Silver Peak Systems, Inc. 1. Unity Edgeconnect, Nx, Vx 2. Unity Orchestrator 3. Edgeconnect In Aws, Azure, Gcp, published May 5, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. No source names a fixed version.