Vulnerability in Aviatrix Controller
CVE-2025-2171
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN
Published · last modified .
EPSS exploit prediction
EPSS: 0.005 (38.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 38.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: +0.000
Affected products
- Aviatrix Controller — versions 7.1.4208, 7.2.5090, 8.0.0
Weakness classification (CWE)
References
- github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0003.md (third-party-advisory)
- cloud.google.com/blog/topics/threat-intelligence/remote-code-execution-aviatrix… (technical-description)