CVE-2012-3372
published 2012-07-09CVE-2012-3372: The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers'…
PriorityP272high7.4CVSS 3.1
AVNACHPRNUINSUCHIHAN
ITWVulnCheck KEV
Exploited in the wild
EPSS
0.94%
56.4th percentile
The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Cyberoam_SSL_CA certificate in a list of trusted root certification authorities. NOTE: the vendor disputes the significance of this issue because the appliance "does not allow import or export of the foresaid private key.
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
vulncheck7.4HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9qf5-mg9m-h7pc: ** DISPUTED ** The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across diff
ghsa_unreviewed·2022-05-17
CVE-2012-3372 [MEDIUM] GHSA-9qf5-mg9m-h7pc: ** DISPUTED ** The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across diff
** DISPUTED ** The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Cyberoam_SSL_CA certificate in a list of trusted root certification authorities. NOTE: the vendor disputes the significance of this issue because the appliance "does not allow import or export of the foresaid private key."
VulnCheck
Cyberoam UTM Cyberoam_SSL_CA Certificate Vulnerability
vulncheck·2012·CVSS 7.4
CVE-2012-3372 [HIGH] Cyberoam UTM Cyberoam_SSL_CA Certificate Vulnerability
Cyberoam UTM Cyberoam_SSL_CA Certificate Vulnerability
The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Cyberoam_SSL_CA certificate in a list of trusted root certification authorities. NOTE: the vendor disputes the significance of this issue because the appliance "does not allow import or export of the foresaid private key.
Affected: elitecore cyberoam_unified_threat_management
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https:/
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/bugtraq/2012-07/0021.htmlhttp://blog.cyberoam.com/2012/07/ssl-bridging-cyberoam-approach/http://www.theregister.co.uk/2012/07/07/cyberoam_tor_ssl_spying_flap/https://blog.torproject.org/blog/security-vulnerability-found-cyberoam-dpi-devices-cve-2012-3372https://media.torproject.org/misc/2012-07-03-cyberoam-CVE-2012-3372.txthttp://archives.neohapsis.com/archives/bugtraq/2012-07/0021.htmlhttp://blog.cyberoam.com/2012/07/ssl-bridging-cyberoam-approach/http://www.theregister.co.uk/2012/07/07/cyberoam_tor_ssl_spying_flap/https://blog.torproject.org/blog/security-vulnerability-found-cyberoam-dpi-devices-cve-2012-3372https://media.torproject.org/misc/2012-07-03-cyberoam-CVE-2012-3372.txt
2012-07-09
Published
Exploited in the wild