The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted Orchestrator.
Weakness
The product does not validate, or incorrectly validates, a certificate.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Unity_edgeconnect_for_amazon_web_services | Silver-peak | - (including) | - (including) |
| Unity_edgeconnect_for_azure | Silver-peak | - (including) | - (including) |
| Unity_edgeconnect_for_google_cloud_platform | Silver-peak | - (including) | - (including) |
| Unity_orchestrator | Silver-peak | * | 8.9.2 (excluding) |