Live › vulnerability › CVE-2024-50603
Go to dashboardAviatrix Controllers, cloud network management appliances, have an OS command injection flaw in the /v1/api endpoint. An unauthenticated attacker can send shell metacharacters in cloud_type or src_cloud_type to run arbitrary commands on the controller.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Aviatrix Controllers | vendor | – | – |
| aviatrix controller | vendor | < 7.1.4191 | 7.1.4191 |
| aviatrix controller | vendor | >= 7.2, < 7.2.4996 | 7.2.4996 |
Check whether an Aviatrix Controller is reachable from untrusted networks and whether /v1/api is exposed.
Apply the vendor mitigations from Aviatrix per CISA guidance, or discontinue use of the product if mitigations are unavailable.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2024-50603")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.