{"id":"CVE-2012-3372","aliases":["EUVD-2012-3345","GHSA-9qf5-mg9m-h7pc"],"status":"disputed","title":"** DISPUTED ** The default configuration of Cyberoam UTM appliances uses the same Certification...","description":"The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Cyberoam_SSL_CA certificate in a list of trusted root certification authorities.  NOTE: the vendor disputes the significance of this issue because the appliance \"does not allow import or export of the foresaid private key.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00938,"percentile":0.61127,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-310"],"published":"2012-07-09T10:00:00Z","modified":"2026-06-16T23:43:05Z","products":[{"vendor":"elitecore","product":"cyberoam_unified_threat_management"}],"references":[{"url":"https://media.torproject.org/misc/2012-07-03-cyberoam-CVE-2012-3372.txt","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.theregister.co.uk/2012/07/07/cyberoam_tor_ssl_spying_flap/","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://blog.torproject.org/blog/security-vulnerability-found-cyberoam-dpi-devices-cve-2012-3372","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2012-07/0021.html","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://blog.cyberoam.com/2012/07/ssl-bridging-cyberoam-approach/","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3372"},{"url":"http://blog.cyberoam.com/2012/07/ssl-bridging-cyberoam-approach"},{"url":"http://www.theregister.co.uk/2012/07/07/cyberoam_tor_ssl_spying_flap"},{"url":"https://github.com/advisories/GHSA-9qf5-mg9m-h7pc"}],"sources":{"cve":[{"id":"CVE-2012-3372","description":"The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Cyberoam_SSL_CA certificate in a list of trusted root certification authorities.  NOTE: the vendor disputes the significance of this issue because the appliance \"does not allow import or export of the foresaid private key.","status":"disputed","published":"2012-07-09T10:00:00Z","modified":"2025-01-27T21:07:51.463Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:34:50.615647Z"}],"euvd":[{"id":"EUVD-2012-3345","description":"The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Cyberoam_SSL_CA certificate in a list of trusted root certification authorities.  NOTE: the vendor disputes the significance of this issue because the appliance \"does not allow import or export of the foresaid private key.","status":"published","published":"2012-07-09T10:00:00Z","modified":"2025-01-27T21:07:51Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:04:11.814906Z"}],"ghsa":[{"id":"GHSA-9qf5-mg9m-h7pc","title":"** DISPUTED ** The default configuration of Cyberoam UTM appliances uses the same Certification...","description":"** DISPUTED ** The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Cyberoam_SSL_CA certificate in a list of trusted root certification authorities.  NOTE: the vendor disputes the significance of this issue because the appliance \"does not allow import or export of the foresaid private key.\"","status":"published","published":"2022-05-17T05:28:03Z","modified":"2025-01-27T21:31:46Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T14:59:41.697715Z"}],"nvd":[{"id":"CVE-2012-3372","description":"The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Cyberoam_SSL_CA certificate in a list of trusted root certification authorities.  NOTE: the vendor disputes the significance of this issue because the appliance \"does not allow import or export of the foresaid private key.","status":"disputed","published":"2012-07-09T10:20:44.417Z","modified":"2026-06-16T23:43:05.787Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:14.774945Z"}]}}