CVE-2012-3372

CVE-2012-3372 is a high-severity vulnerability in Elitecore Cyberoam Unified Threat Management with a CVSS 3.x base score of 7.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-310.

Key facts

Description

The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Cyberoam_SSL_CA certificate in a list of trusted root certification authorities. NOTE: the vendor disputes the significance of this issue because the appliance "does not allow import or export of the foresaid private key.

Frequently asked questions

What is CVE-2012-3372?
The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Cyberoam_SSL_CA certificate in a list of trusted root certification authorities. NOTE: the vendor disputes the significance of this issue because the appliance "does not allow import or export of the foresaid private key.
How severe is CVE-2012-3372?
CVE-2012-3372 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2012-3372 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (57th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2012-3372?
CVE-2012-3372 affects Elitecore Cyberoam Unified Threat Management. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2012-3372?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2012-3372 published?
CVE-2012-3372 was published on 2012-07-09 and last updated on 2026-06-16.

References

Affected products (1)

More vulnerabilities in Elitecore Cyberoam Unified Threat Management

All CVEs affecting Elitecore Cyberoam Unified Threat Management →

Other CWE-310 (Cryptographic Issues) vulnerabilities

Browse all CWE-310 (Cryptographic Issues) vulnerabilities →