Vulnerability · Published Jun 23, 2025 · Assigned by Mandiant
CVE-2025-2172
Medium 6.6
In plain English
A medium-severity OS command injection in Controller from Aviatrix. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 12.2% (higher than 96% of all known vulnerabilities).
Severity (CVSS 4.0)6.6Medium
Exploit odds (30 days)12.2%top 3.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Aviatrix | Controller | see references |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P