CVE-2020-12149

OS Command Injection - Management File Upload

MEDIUM

6.8

CVSS Score

Published: December 11, 2020 at 03:23 PM UTC

Updated: June 17, 2026 at 02:51 AM UTC

22 products affected across 2 vendorsEdgeconnect EnterpriseNx-700Vx-5000

Using ECOS by Silver Peak Systems, Inc.?

Get instant alerts when new vulnerabilities affect ECOS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.8

Exploit prediction

EPSS 1%

Description

The configuration backup/restore function in Silver Peak Unity ECOSTM (ECOS) appliance software was found to directly incorporate the user-controlled config filename in a subsequent shell command, allowing an attacker to manipulate the resulting command by injecting valid OS command input. This vulnerability can be exploited by an attacker with authenticated access to the Orchestrator UI or EdgeConnect UI. This affects all ECOS versions prior to: 8.1.9.15, 8.3.0.8, 8.3.1.2, 8.3.2.0, 9.0.2.0, and 9.1.0.0.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Edgeconnect Enterprise · Aruba Networks

95%

v < 8.1.9.158.1 ≤ v < 8.1.9.158.3.0 ≤ v < 8.3.0.88.3.1 ≤ v < 8.3.1.29.0 ≤ v < 9.0.2.08.3.0.8 8.3.1.2 8.3.2.0 9.0.2.0 and 9.1.0.0

Affected range stops below 8.1.9.15, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.3.0.8, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.3.1.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.0.2.0, so it looks safe — our inference, not a vendor statement

arubanetworks-nx-10700 (environment) · arubanetworks-nx-11700 (environment) · arubanetworks-nx-1700 (environment) · arubanetworks-nx-2700 (environment) · arubanetworks-nx-3700 (environment) · arubanetworks-nx-5700 (environment) · arubanetworks-nx-6700 (environment) · arubanetworks-nx-700 (environment) · arubanetworks-nx-7700 (environment) · arubanetworks-nx-8700 (environment) · arubanetworks-nx-9700 (environment) · arubanetworks-vx-1000 (environment) · arubanetworks-vx-2000 (environment) · arubanetworks-vx-3000 (environment) · arubanetworks-vx-500 (environment) · arubanetworks-vx-5000 (environment) · arubanetworks-vx-6000 (environment) · arubanetworks-vx-7000 (environment) · arubanetworks-vx-8000 (environment) · arubanetworks-vx-9000 (environment) · silver-peak-unity-edgeconnect (environment)

Nx-10700 · Aruba Networksdevice

80%

All versions

Nx-11700 · Aruba Networksdevice

80%

All versions

Nx-1700 · Aruba Networksdevice

80%

All versions

Nx-2700 · Aruba Networksdevice

80%

All versions