What’s Vulnerable › Vulnerabilities

CVE-2021-40870: Aviatrix Controller Unrestricted Upload of File

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-01-18
• EPSS: 93.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-09-13 · updated 2026-06-17
• Weakness: CWE-23

Description

An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.

Affected products

• Aviatrix Controller: from 6.2 before 6.2.2043; from 6.3 before 6.3.2490; from 6.4 before 6.4.2838; from 6.5 before 6.5.1922 — fixed in 6.2.2043, 6.3.2490, 6.4.2838, 6.5.1922

How to fix

Upgrade to a fixed version: Aviatrix Controller 6.2.2043, 6.3.2490, 6.4.2838, 6.5.1922. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/164461/Aviatrix-Controller-6.x-Path-Traversal-Code-Execution.html
• https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html#security-note-9-11-2021
• https://wearetradecraft.com/advisories/tc-2021-0002/
• http://packetstormsecurity.com/files/164461/Aviatrix-Controller-6.x-Path-Traversal-Code-Execution.html
• https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html#security-note-9-11-2021
• https://wearetradecraft.com/advisories/tc-2021-0002/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40870

Get alerted when CVE-2021-40870 or the next vulnerability affects your stack