The certificate used to identify Orchestrator to EdgeConnect devices is not validated
The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted Orchestrator.
Any required configuration
• Do not change Orchestrator’s IP address as discovered by the EdgeConnect appliance.
• Upgrade to Silver Peak Unity ECOS™ 8.3.2+ or 8.1.9.12+ and Silver Peak Unity Orchestrator™ 8.9.2+.
• In Orchestrator, enable the “Verify Orchestrator Certificate” option under Advanced Security Settings.
Solution link - References
The full details of the CVE can be found at https://www.silver-peak.com/sites/default/files/advisory/security_advisory_notice_rogue_orchestrator_cve_2020_12143.pdf
Configurations
Any required configuration
• Do not change Orchestrator’s IP address as discovered by the EdgeConnect appliance.
• Upgrade to Silver Peak Unity ECOS™ 8.3.2+ or 8.1.9.12+ and Silver Peak Unity Orchestrator™ 8.9.2+.
• In Orchestrator, enable the “Verify Orchestrator Certificate” option under Advanced Security Settings.
Solution link - References
The full details of the CVE can be found at https://www.cvedetails.com/cve/CVE-2020-12143.
Workarounds
Exploits
Credits
This vulnerability was reported to Silver Peak by Denis Kolegov, Mariya Nedyak, and Anton Nikolaev from the SD-WAN New Hop team.