Secuno
ENNL
Book demo

CVE-2024-50603

Aviatrix Controllers OS Command Injection

10.0 CRITICALActively exploited (CISA KEV)Public exploitEPSS 98.5%
  1. Published8 Jan 2025
  2. Added to CISA KEV16 Jan 2025
  3. Remediation due6 Feb 2025
Actively exploited (CISA KEV)

Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.

Added to KEV: 16 Jan 2025Federal remediation due: 6 Feb 2025

Description

An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Aviatrix Controller≥ 7.2 < 7.2.4996 · < 7.1.4191

Remediation

Fixed in
Aviatrix Controller≥ 7.2.4996

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-10911010.0
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function…
CVE-2026-1091089.9
A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This…
CVE-2026-820968.8
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker…
CVE-2026-185298.7
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is…
CVE-2025-714299.8
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in…
CVE-2020-372798.1
easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that…

Frequently asked

Is CVE-2024-50603 being actively exploited?

Yes. CVE-2024-50603 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 16 Jan 2025.

How severe is CVE-2024-50603?

CVE-2024-50603 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 98.5% probability of exploitation.

Which products are affected by CVE-2024-50603?

Affected products include Aviatrix Controller.

How do I fix CVE-2024-50603?

Upgrade affected software to a fixed version, for example Aviatrix Controller 7.2.4996 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-50603 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.