{"id":"CVE-2024-50603","published":"2025-01-08T01:15:07Z","modified":"2026-06-17T08:04:47Z","title":"Aviatrix Controllers OS Command Injection Vulnerability","vendor":"Aviatrix","product":"Controllers","tier":"core","eol":null,"description":{"text":"An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.","provenance":"source","from":"NVD"},"summary":{"text":"Aviatrix Controllers (Aviatrix product line) contain an OS command injection flaw, where special elements are not neutralised before being used in an operating system command. An unauthenticated attacker with network access to the controller's API can send shell metacharacters in the cloud_type parameter of list_flightpath_destination_instances or the src_cloud_type parameter of flightpath_connection_test at /v1/api, and no user interaction or configuration is required to execute arbitrary code.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:35:55Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.98518,"percentile":0.99921,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-01-16","dueDate":"2025-02-06","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true ; https://nvd.nist.gov/vuln/detail/CVE-2024-50603","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-01-07","exploitedFirstSeen":"2025-01-07","ransomware":false,"evidence":[{"url":"https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true#remote-code-execution-vulnerability-in-aviatrix-controllers","date":"2025-01-07"},{"url":"https://www.wiz.io/blog/wiz-research-identifies-exploitation-in-the-wild-of-aviatrix-cve-2024-50603","date":"2025-01-11"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-01-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-03&host_type=src&vulnerability=cve-2024-50603","date":"2025-02-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-05&host_type=src&vulnerability=cve-2024-50603","date":"2025-02-05"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-06&host_type=src&vulnerability=cve-2024-50603","date":"2025-02-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-07&host_type=src&vulnerability=cve-2024-50603","date":"2025-02-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-08&host_type=src&vulnerability=cve-2024-50603","date":"2025-02-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-11&host_type=src&vulnerability=cve-2024-50603","date":"2025-02-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-13&host_type=src&vulnerability=cve-2024-50603","date":"2025-02-13"}],"evidenceTotal":373,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://docs.aviatrix.com/documentation/latest/network-security/index.html","tags":["Product"]},{"url":"https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true#remote-code-execution-vulnerability-in-aviatrix-controllers","tags":["Vendor Advisory"]},{"url":"https://www.securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50603","tags":["US Government Resource"]}],"techniques":[{"id":"T1055","name":"Process Injection","tactics":["privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"exploitation_technique","evidence":[],"comment":"Due to improper handling of user input, an attacker can insert shell metacharacters into specific parameters, permitting the execution of arbitrary commands.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Command Injection","mappingType":"primary_impact","evidence":[],"comment":"Due to improper handling of user input, an attacker can insert shell metacharacters into specific parameters, permitting the execution of arbitrary commands.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-44623","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44623","exploited":true,"exploitedSince":"2025-01-16","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2025-01-08","earliestUrl":"https://github.com/newlinesec/CVE-2024-50603","repos":[{"name":"th3gokul/CVE-2024-50603","url":"https://github.com/th3gokul/CVE-2024-50603","stars":17,"created":"2025-01-12"},{"name":"newlinesec/CVE-2024-50603","url":"https://github.com/newlinesec/CVE-2024-50603","stars":7,"created":"2025-01-08"}]},"nuclei":[{"id":"CVE-2024-50603","name":"Aviatrix Controller - Remote Code Execution","severity":"critical","path":"http/cves/2024/CVE-2024-50603.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50603.yaml"}],"first":{"date":"2025-01-08","source":"PoC-in-GitHub","url":"https://github.com/newlinesec/CVE-2024-50603"},"provenance":"source"},"exploitRefs":["https://www.securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/"],"flow":[{"stage":"exploitation","techniques":["T1055"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2025-01-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true#remote-code-execution-vulnerability-in-aviatrix-controllers","provenance":"source"},{"date":"2025-01-08","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50603","provenance":"source"},{"date":"2025-01-08","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/newlinesec/CVE-2024-50603","provenance":"source"},{"date":"2025-01-16","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-01-16","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44623","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":8},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 662 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9992"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}