CVE-2024-50603

🗓️ 08 Jan 2025 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 13 Media mentions👁 264 Views🌐 WEB

Vulnerability in Aviatrix Controller allows code execution via OS command injection by unauthenticated users.

Reporter	Title	Published	Views	Family All 24
GithubExploit	Exploit for OS Command Injection in Aviatrix Controller	8 Jan 202512:00	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Aviatrix Controller	12 Jan 202511:20	–	githubexploit
ATTACKERKB	CVE-2024-50603	8 Jan 202500:00	–	attackerkb
Tenable Nessus	Aviatrix Controllers < 7.1.4191 / 7.2 < 7.2.4996 RCE	23 Oct 202500:00	–	nessus
Circl	CVE-2024-50603	8 Jan 202501:09	–	circl
CISA KEV Catalog	Aviatrix Controllers OS Command Injection Vulnerability	16 Jan 202500:00	–	cisa_kev
CISA	CISA Adds One Known Exploited Vulnerability to Catalog	16 Jan 202512:00	–	cisa
CNNVD	Aviatrix Controller 操作系统命令注入漏洞	8 Jan 202500:00	–	cnnvd
Cvelist	CVE-2024-50603	8 Jan 202500:00	–	cvelist
HackRead	Hackers Use CVE-2024-50603 to Deploy Backdoor on Aviatrix Controllers	15 Jan 202509:29	–	hackread

NVD

Vulners

CNA

Node

aviatrix controllerRange<7.1.4191

aviatrix controllerRange7.2–7.2.4996

[
  {
    "defaultStatus": "unaffected",
    "product": "Controller",
    "vendor": "Aviatrix",
    "versions": [
      {
        "lessThan": "7.1.4191",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      },
      {
        "lessThan": "7.2.4996",
        "status": "affected",
        "version": "7.2.0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
docs	www.docs.aviatrix.com/documentation/latest/network-security/index.html
docs	www.docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html
securing	www.securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
cloud_type	request body	/v1/api	Command injection via shell metacharacters in cloud_type for list_flightpath_destination_instances	CWE-78
src_cloud_type	request body	/v1/api	Command injection via shell metacharacters in src_cloud_type for flightpath_connection_test	CWE-78

05 Nov 2025 19:11Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8 - 10

EPSS0.94362

SSVC