CVE-2021-40870: Aviatrix Controller Unrestricted Upload of File
Vulnerability summary
CVE-2021-40870 is a critical (CVSS 9.8) Relative Path Traversal vulnerability in Aviatrix Aviatrix Controller. It is known to be exploited: CISA lists it, first on 18-01-2022. EPSS estimates a 93.02% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 13-09-2021PublishedVulnerability first disclosed.
- 18-01-2022Added to CISA KEVAviatrix Controller Unrestricted Upload of File
- 01-02-2022CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
93.02%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 93.02% on 20-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 18-01-2022
- Federal due date
- 01-02-2022
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2021-40870
Public exploits
2 foundExploit Reference (wearetradecraft.com)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Aviatrix1 product
- controller≥ 6.2, < 6.2.2043 | ≥ 6.3, < 6.3.2490 | ≥ 6.4, < 6.4.2838 | ≥ 6.5, < 6.5.1922
1 vendor · 1 product
References
4 links- packetstormsecurity.com/files/164461/Aviatrix-Controller-6.x-Path-Traversal-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40870Government ResourceUS Government Resource