Silver Peak Systems, Inc.
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| 1. Unity EdgeConnect, NX, VX 2. Unity Orchestrator, 3. EdgeConnect in AWS, Azure, GCP | 3 | – | May 5, 2020 |
| Unity Orchestrator | 3 | – | Nov 5, 2020 |
| ECOS | 2 | – | Dec 11, 2020 |
Exploited and recent CVEs
- CVE-2020-12148 OS Command Injection - nslookup API 2.1%
- CVE-2020-12149 OS Command Injection - Management File Upload 1.3%
- CVE-2020-12146 Silver Peak Unity OrchestratorTM subject to path traversal. 27.6%
- CVE-2020-12147 Unauthorized queries against the Silver Peak Unity OrchestratorTM MySQL database. 1.5%
- CVE-2020-12145 Silver Peak Unity OrchestratorTM authentication can be subverted through manipulation of HTTP headers. 6.0%
- CVE-2020-12142 IPSec UDP key material can be retrieved from EdgeConnect by a user with admin credentials 0.7%
- CVE-2020-12144 The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated 0.3%
- CVE-2020-12143 The certificate used to identify Orchestrator to EdgeConnect devices is not validated 0.3%