Most Exploited Internet-Facing Products

MEIFP

Back to Ranking

Aviatrix

Products: Controller

40.6

Score

3

CVEs

1

Active

2

PoC

1

KEV

#72

Rank

Period:

Product:

CVE ID	Published	CVSS	Exploit	KEV	AC	PR	Auto	Score(hover)	Affected Products	Description
CVE-2025-2171	2025-06-23	7.8v4.0	POC	—	Low	None	no	0.0	Controller	Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN
CVE-2025-2172	2025-06-23	6.6v4.0	POC	—	High	High	no	0.0	Controller	Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames
CVE-2024-50603	2025-01-08	10.0v3.1	ACTIVE		Low	None	YES	40.6	Controller	An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_fl

Each CVE: 10 pts base (Active only), boosted by:

KEV×2.0AC: Low×1.2PR: None×1.3PR: Low×1.1Auto×1.3