PT-2025-26597 · Aviatrix · Aviatrix Controller

Louis Dion-Marcil · Published 2025-06-23 · Updated 2025-07-31 · CVE-2025-2172

Positive Technologies (AI Summary)

CVSS v4.0

7.5

High

Base vector

AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Aviatrix Controller versions prior to 7.1.4208 Aviatrix Controller versions prior to 7.2.5090 Aviatrix Controller versions prior to 8.0.0

Description: The issue is related to the failure of the Aviatrix Controller to sanitize user input before passing it to command line utilities. This allows command injection via special characters in filenames.

Recommendations: For versions prior to 7.1.4208, update to version 7.1.4208 or later. For versions prior to 7.2.5090, update to version 7.2.5090 or later. For versions prior to 8.0.0, update to version 8.0.0 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-2172

Affected Products

Aviatrix Controller

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-2172 · Security Note
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0004.md · Note
• https://cloud.google.com/blog/topics/threat-intelligence/remote-code-execution-aviatrix-controller · Note
• https://twitter.com/TweetThreatNews/status/1937470961223123264 · Twitter Post
• https://t.me/latest_high_impact_cve/2784 · Telegram Post
• https://twitter.com/dailytechonx/status/1937654471104012299 · Twitter Post
• https://t.me/cvetracker/26834 · Telegram Post
• https://twitter.com/Xasha_agent/status/1937331839427125467 · Twitter Post
• https://twitter.com/fridaysecurity/status/1937331685156159835 · Twitter Post
• https://twitter.com/Komodosec/status/1950981331086876696 · Twitter Post
• https://twitter.com/CVEnew/status/1937152825772978511 · Twitter Post
• https://t.me/pentestingnews/63290 · Telegram Post