Critical severity · published Jan 8, 2025
CVE-2024-50603
Aviatrix Controllers OS Command Injection Vulnerability
In wildKEV
9.8
CVSS
98.5%
EPSS
Yes
On KEV
Description
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)98.5% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Jan 16, 2025
Federal remediation dueFeb 6, 2025
Ransomware campaign useNot known
Affected products
Which versions
CO
Controller · Aviatrix
before 7.1.4191; 7.2.0 before 7.2.4996 · source: vendor, NVD
CO
Controllers · Aviatrix
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-50603
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-50603
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
docs.aviatrix.com
https://docs.aviatrix.com/documentation/latest/network-security/index.html
docs.aviatrix.com
https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true#remote-code-execution-vulnerability-in-aviatrix-controllers
www.securing.pl
https://www.securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/
More from Controller
9.8
CVE-2021-40870
Aviatrix Controller Unrestricted Upload of File
9.8
CVE-2020-26553
An issue was discovered in Aviatrix Controller before R6.0.2483
9.8
CVE-2020-13417
An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224
8.8
CVE-2020-26548
An issue was discovered in Aviatrix Controller before R5.4.1290
8.8
CVE-2020-13412
An issue was discovered in Aviatrix Controller before 5.4.1204