CVE-2024-50603: Aviatrix Controllers OS Command Injection Vulnerability

Vulnerability summary

CVE-2024-50603 is a critical (CVSS 10.0) OS Command Injection vulnerability in Aviatrix Controllers. It is known to be exploited: CISA lists it, first on 16-01-2025. EPSS estimates a 98.52% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 08-01-2025
   PublishedVulnerability first disclosed.
2. 16-01-2025
   Added to CISA KEVAviatrix Controllers OS Command Injection Vulnerability
3. 06-02-2025
   CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.