CVE-2024-50603

Published Jan 8, 2025

Last updated a month ago

Exploit known CVSS critical 10.0

Overview

Description: An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Aviatrix Controllers OS Command Injection Vulnerability
Exploit added on: Jan 16, 2025
Exploit action due: Feb 6, 2025
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

cve@mitre.org: CWE-78
nvd@nist.gov: CWE-78

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:aviatrix:controller:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EEFBF1E7-29E2-4576-9492-80A82D4D93EC",
            "versionEndExcluding": "7.1.4191"
          },
          {
            "criteria": "cpe:2.3:a:aviatrix:controller:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F60A1799-EC49-48EF-AD1B-0F79DE5A0EEE",
            "versionEndExcluding": "7.2.4996",
            "versionStartIncluding": "7.2"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

References