CVE-2024-50603
Aviatrix Controllers OS Command Injection Vulnerability
Aviatrix Controllers
CVSS
10.0CriticalExploit odds (EPSS)98.5%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
CISA required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA KEV
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
Public exploit code and templates 1
- Scanner templateAviatrix Controller - Remote Code ExecutionNuclei
Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.
Description
Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
Text from CVE List
Affected versions 2
- Controlleraffected: all versions before 7.1.4191CVE List
- Controlleraffected: 7.2.0 before 7.2.4996CVE List
References 6
- docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=trueAdvisoryvia CISA KEV
- docs.aviatrix.com/documentation/latest/network-security/index.htmlAdvisoryvia CVE List
- docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true#remote-code-execution-vulnerability-in-aviatrix-controllersAdvisoryvia CVE List
- nvd.nist.gov/vuln/detail/CVE-2024-50603Referencevia CISA KEV
- securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/Referencevia CVE List
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50603Referencevia CVE List