Actively exploited in the wild
Aviatrix Controller Unrestricted Upload of File
Aviatrix - Aviatrix Controller · Listed in the CISA KEV since 2022-01-18. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-40870
CriticalCVSS 9.8KEVSummary
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
Risk Assessment
The risk includes potential remote code execution by an unauthenticated attacker, which could lead to full compromise of the Aviatrix Controller.
Recommendation
It is recommended to immediately upgrade Aviatrix Controller to version 6.5-1804.1922 or later and restrict access to the administrative interface.
Other vulnerabilities in Aviatrix Controller
Original NVD description (English source)
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.