CVE-2024-50603: Aviatrix Controller unauthenticated OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS of 9.8, active exploitation per KEV, and near-certain EPSS probability make this an urgent patching priority.

What it is

Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996 fails to neutralize shell metacharacters passed to the /v1/api endpoint, allowing OS command injection. An unauthenticated remote attacker can execute arbitrary code on the controller, which is a high-value management component for cloud networking.

Impact

An attacker gains arbitrary command execution on the Aviatrix Controller with the privileges of the service, enabling full compromise of the controller and potentially the managed cloud network.

Attack surface

Reachable over the network via the /v1/api endpoint, specifically the cloud_type parameter for list_flightpath_destination_instances and src_cloud_type for flightpath_connection_test. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CISA added this to KEV on 2025-01-16 with a 2025-02-06 remediation due, and EPSS shows a 30-day probability of 0.98545 (99.92nd percentile). A public exploit reference is listed, indicating active exploitation in the wild.

What to do

• Upgrade Aviatrix Controller to 7.1.4191 or later, or 7.2.4996 or later, per the vendor advisory.
• If immediate patching is not possible, restrict network access to the controller management interface and /v1/api to trusted sources only.
• Monitor vendor guidance for any interim mitigations and apply them as directed.
• Review controller logs and configurations for signs of unauthorized command execution or persistence.
• Consider discontinuing use of the product if mitigations cannot be applied, as directed by CISA.

Detection

• Inspect HTTP requests to /v1/api for shell metacharacters in cloud_type and src_cloud_type parameters.
• Alert on unexpected child processes or command shells spawned by the Aviatrix Controller service.
• Monitor for outbound connections from the controller to unknown hosts that may indicate command-and-control or data exfiltration.
• Review controller audit logs for anomalous API calls to list_flightpath_destination_instances and flightpath_connection_test.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.