RCE in Aviatrix Controller
CVE-2025-2172
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
EPSS exploit prediction
EPSS: 0.122 (96.0th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 96.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.104 · newest: 0.122 · change: +0.018
Affected products
- Aviatrix Controller — versions 7.1.4208, 7.2.5090, 8.0.0
Weakness classification (CWE)
References
- github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0004.md (third-party-advisory)
- cloud.google.com/blog/topics/threat-intelligence/remote-code-execution-aviatrix… (technical-description)