CVE-2021-40870: Aviatrix Controller unauthenticated file upload leads to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a 9.8 CVSS score, KEV listing, and near-maximum EPSS probability makes this an urgent patch.

What it is

Aviatrix Controller 6.x before 6.5-1804.1922 allows unrestricted upload of a dangerous file type, and directory traversal lets an unauthenticated attacker place and execute arbitrary code. The flaw is remotely reachable with no credentials or user interaction, making it a direct path to full compromise of the controller.

Impact

An attacker gains remote code execution on the Aviatrix Controller, which can lead to full control of the controller and the network infrastructure it manages.

Attack surface

Reachable over the network via the controller's web interface; the CVSS vector shows no privileges required and no user interaction. No authentication is needed to attempt the upload and traversal.

Exploitation

Listed in CISA KEV since 2022-01-18 with a required action to apply vendor updates, and EPSS 30-day probability is 0.93 (99.8th percentile). Public exploit references are tagged Exploit, indicating working exploit code is available.

What to do

• Upgrade Aviatrix Controller to 6.5-1804.1922 or later per the vendor release notes.
• If immediate patching is not possible, restrict network access to the controller management interface to trusted hosts only.
• Monitor and block directory traversal patterns and unexpected file uploads at the perimeter or WAF.
• Rotate credentials and review controller logs for signs of compromise after exposure.
• Verify no unauthorized files or processes were placed on the controller before remediation.

Detection

• Inspect controller and web server logs for upload requests containing traversal sequences such as ../ or encoded variants.
• Alert on file creation in web-accessible or executable directories outside expected deployment paths.
• Monitor for unexpected outbound connections or new processes spawned by the controller service.
• Hunt for known exploit request patterns against the controller endpoint using the public advisory indicators.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.