Skip to main content

Controller CVE-2024-50603

CRITICAL
OS Command Injection (CWE-78)
2025-01-08 cve@mitre.org
RCE Command Injection Controller Aviatrix
10.0
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-78
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK

2 techniques across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

Critical risk (CVSS 10.0, EPSS 94.4%). Aviatrix Controller manages multi-cloud networking infrastructure. Compromising the controller provides access to cloud network configurations, routing tables, and the ability to modify traffic paths across AWS, Azure, GCP, and OCI environments.
Exploit ScenarioDerived

An attacker sends a crafted request to /v1/api with shell metacharacters in the cloud_type parameter. The command injection executes on the Aviatrix Controller, providing access to cloud API credentials, network configurations, and the ability to reroute or intercept cloud traffic.
Emergency Immediate action required. Why: CRITICAL + in CISA KEV (actively exploited), no patch available.
Exploited in the wild (CISA KEV) No patch listed yet 94.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 28, 2026

Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996 contains an OS command injection via improper neutralization of special elements in the /v1/api endpoint, allowing unauthenticated remote code execution.

Earlier versions of this analysis (1)
v1 Mar 28, 2026 - 18:02 CVSS 10.0

A critical OS command injection vulnerability in Aviatrix Controller allows unauthenticated remote code execution through shell metacharacters in the cloud_type parameter of the /v1/api endpoint.

RemediationAI

Update Aviatrix Controller immediately. Rotate all cloud API credentials accessible from the controller. Review cloud network configurations for unauthorized modifications. Restrict controller management interface access.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The CWE-78 command injection in the list_flightpath_destination_instances and src_cloud_type parameters of /v1/api fails to sanitize shell metacharacters. Attackers inject OS commands that execute with the privileges of the Aviatrix Controller process.

Know when Controller gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 10.0 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Added to CISA KEV
Nov 05, 2025 - 19:11 cisa
CISA KEV
PoC Detected
Nov 05, 2025 - 19:11 vuln.today
Public exploit code
CVE Published
Jan 08, 2025 - 01:15 nvd
CRITICAL 10.0

DescriptionCVE.org

An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.

Executive ViewAI

Why It Matters

Organizations using Aviatrix Controller face critical risk from CVE-2024-50603, a OS command injection vulnerability rated CVSS 10.0. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Deploy WAF rules to block injection patterns; (2) Restrict network access to affected components; (3) Enable enhanced logging for suspicious activity.

Threat Intelligence Overview

Threat Score
7.8/10
Composite threat intelligence
EPSS Score
94.4%
Top 0% exploitable
Exploit
POC
Public exploit code exists
Data Quality
4 sources
Confidence: Medium
NVD CVE.org CISA KEV EPSS POC (1)

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV Yes
Public POC Yes
EPSS 94.4%
Patch available No
Active threat Yes
Deciding rule
CRITICAL + in CISA KEV (actively exploited), no patch available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Immediate
Exploitation· derived
Active
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

214
Low Medium High Critical
KEV: +50
EPSS: +94
CVSS: +50
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:aviatrix:controller:*:*:*:*:*:*:*:*
cpe:2.3:a:aviatrix:controller:*:*:*:*:*:*:*:*

More in Controller

View all
CVE-2021-40870 CRITICAL POC
9.8 Sep 13

An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Rated critical severity (CVSS 9.8), this vulner
CVE-2020-26553 CRITICAL POC
9.8 Nov 17

An issue was discovered in Aviatrix Controller before R6.0.2483. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2020-13417 CRITICAL POC
9.8 May 22

An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CV
CVE-2020-26548 HIGH POC
8.8 Nov 17

An issue was discovered in Aviatrix Controller before R5.4.1290. Rated high severity (CVSS 8.8), this vulnerability is r
CVE-2020-26552 HIGH POC
7.5 Nov 17

An issue was discovered in Aviatrix Controller before R6.0.2483. Rated high severity (CVSS 7.5), this vulnerability is r
CVE-2020-26551 HIGH POC
7.5 Nov 17

An issue was discovered in Aviatrix Controller before R5.3.1151. Rated high severity (CVSS 7.5), this vulnerability is r
CVE-2020-26550 HIGH POC
7.5 Nov 17

An issue was discovered in Aviatrix Controller before R5.3.1151. Rated high severity (CVSS 7.5), this vulnerability is r
CVE-2020-26549 HIGH POC
7.5 Nov 17

An issue was discovered in Aviatrix Controller before R5.4.1290. Rated high severity (CVSS 7.5), this vulnerability is r
CVE-2020-13415 HIGH POC
7.5 May 22

An issue was discovered in Aviatrix Controller through 5.1. Rated high severity (CVSS 7.5), this vulnerability is remote
CVE-2020-13414 HIGH POC
7.5 May 22

An issue was discovered in Aviatrix Controller before 5.4.1204. Rated high severity (CVSS 7.5), this vulnerability is re
CVE-2020-13413 MEDIUM POC
5.3 May 22

An issue was discovered in Aviatrix Controller before 5.4.1204. Rated medium severity (CVSS 5.3), this vulnerability is

CVE-2024-28777 HIGH
8.8 Feb 19

IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to unrestricted deserialization.

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2020-9054 CRITICAL POC
9.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-9474 MEDIUM POC
6.9

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

References

Advisories & patches
ADVISORY https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true#remote-code-execution-vulnerability-in-aviatrix-controllers REF https://docs.aviatrix.com/documentation/latest/network-security/index.html REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50603

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy