The default configuration of Cyberoam UTM appliances uses the same Certification…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Cyberoam_SSL_CA certificate in a list of trusted root certification authorities. NOTE: the vendor disputes the significance of this issue because the appliance "does not allow import or export of the foresaid private key.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2012-3372
- 2026-10-03 Alias added: GHSA-9qf5-mg9m-h7pc
References
Other 5
- https://media.torproject.org/misc/2012-07-03-cyberoam-CVE-2012-3372.txt
- http://www.theregister.co.uk/2012/07/07/cyberoam_tor_ssl_spying_flap/
- https://blog.torproject.org/blog/security-vulnerability-found-cyberoam-dpi-devices-cve-2012-3372
- 20120703 Cyberoam advisory
- http://blog.cyberoam.com/2012/07/ssl-bridging-cyberoam-approach/
More Elitecore Cyberoam Unified Threat Management vulnerabilities
- TI-2011-04327 SQL injection vulnerability in corporate/Controller in Elitecore Technologies Cyberoam… CVSS 2.0MEDIUM 6.0
Sources
- CVE-2012-3372 · CVE Program
- CVE-2012-3372 · NVD
- FIRST EPSS
- GHSA-9qf5-mg9m-h7pc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences