Aviatrix Controller CVE-2025-2171

This vulnerability exploits a missing rate-limiting control on the password reset functionality in Aviatrix Controller, a multi-cloud network infrastructure platform. The root cause is classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts), which describes insufficient protections against brute force attacks on authentication mechanisms. Aviatrix Controller's password reset mechanism generates 6-digit numeric PINs (1,000,000 possible combinations) and transmits them to users; without rate limiting, an attacker can programmatically attempt all combinations from an unauthenticated network position (AV:N). The PIN validation endpoint fails to implement exponential backoff, account lockouts, CAPTCHA challenges, or request throttling. This is a network-accessible authentication bypass rather than a cryptographic weakness—the PIN itself may be weak but is rendered exploitable specifically due to the absence of rate limiting.