Risk Letters

Exploited vulnerability

CVE-2024-50603

TLP:CLEAR

Aviatrix Controllers OS Command Injection Vulnerability

Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.

Facts

  • Vendor: Aviatrix
  • Product: Controllers
  • CVSS: 10
  • EPSS (probability of exploitation within 30 days): 98.5 %
  • On CISA's Known Exploited Vulnerabilities list since: 16 January 2025
  • First known exploitation: 16 January 2025
  • CISA's deadline for US federal agencies: 6 February 2025
  • Weakness: CWE-78
  • First seen by Risk Letters: 16 January 2025

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD