CVE-2025-2172 - Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames

Back Back to CVE browser

MEDIUM

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames

Published Jun 23, 2025

6.6

MEDIUM

CVSS 4.0

EPSS 12.22%

Description

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (3)

https://cloud.google.com/blog/topics/threat-intelligence/remote-code-execution-aviatrix-controller
technical-description
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-18898
Advisory
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0004.md
third-party-advisory

Link	Providers	Tags
https://cloud.google.com/blog/topics/threat-intelligence/remote-code-execution-aviatrix-controller		technical-description
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-18898		Advisory
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0004.md		third-party-advisory