Silver Peak Systems, Inc.

Records17All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

Silver Peak Systems, Inc. records in CISA KEV

No Silver Peak Systems, Inc. vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Unity Edgeconnect Sd-wan Firmware 7 records MEDIUM Unity Orchestrator 6 records MEDIUM Nx-1000 Firmware 3 records LOW Nx-10k Firmware 3 records LOW Nx-11k Firmware 3 records LOW Nx-2000 Firmware 3 records LOW Nx-3000 Firmware 3 records LOW Nx-5000 Firmware 3 records LOW

Records

6 records in Unity Orchestrator · all components

TI-2020-09777 CVE-2020-12146 · GHSA-vxrq-49g3-9pjf

Silver Peak Unity OrchestratorTM subject to path traversal.

MEDIUM 60

In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can access, modify, and delete restricted files on the Orchestrator server using the/debugFiles REST API.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.27569 Published 2020-11-05 No fix listed CWE-22

TI-2020-09776 CVE-2020-12145 · GHSA-q4mf-j4qj-96f2

Silver Peak Unity OrchestratorTM authentication can be subverted through manipulation of HTTP headers.

MEDIUM 51

Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06047 Published 2020-11-05 No fix listed CWE-287

TI-2020-09778 CVE-2020-12147 · GHSA-vxmf-fxwp-m3ww

Unauthorized queries against the Silver Peak Unity OrchestratorTM MySQL database.

MEDIUM 41

In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchestrator database using the /sqlExecution REST API, which had be…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01521 Published 2020-11-05 No fix listed CWE-22

TI-2020-09775 CVE-2020-12144 · GHSA-7qwj-rq2v-gm66

Improper certificate validation in Silver Peak Systems, Inc. 1. Unity EdgeConnect, NX, VX…

LOW 27

The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated.

CVSS 3.1MEDIUM 6.0 Network High privileges User interaction EPSS 0.00335 Published 2020-05-05 No fix listed CWE-295

TI-2020-09774 CVE-2020-12143 · GHSA-c2x3-x977-3v6g

Improper certificate validation in Silver Peak Systems, Inc. 1. Unity EdgeConnect, NX, VX…

LOW 27

The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted Orchestrator.

CVSS 3.1MEDIUM 6.0 Network High privileges User interaction EPSS 0.00335 Published 2020-05-05 No fix listed CWE-295

TI-2020-09773 CVE-2020-12142 · GHSA-g7xc-58w4-v854

IPSec UDP key material can be retrieved from EdgeConnect by a user with admin credentials

LOW 24

1. IPSec UDP key material can be retrieved from machine-to-machine interfaces and human-accessible interfaces by a user with admin credentials.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00722 Published 2020-05-05 No fix listed CWE-668

Open these records in search →