Vulnerability in Aviatrix Controller

CVE-2025-2171

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN

EPSS: 0.005 (36.5th percentile) — read the EPSS interpretation.

Affected products

Aviatrix Controller — versions 7.1.4208, 7.2.5090, 8.0.0

Weakness classification (CWE)

CWE-307 — Improper Restriction of Excessive Authentication Attempts

References

mandiant-cve@google.com (third-party-advisory)
mandiant-cve@google.com (technical-description)