Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Aviatrix Controller allows anyone to run code by uploading files

CVE-2021-40870 · published 5 years ago · actively exploited
Summary

The Aviatrix Controller lets a user who is not logged in upload a file of a harmful type and use folder tricks to execute code on the system. This could let an attacker take control of the controller. Apply the vendor's update or disable unrestricted file uploads and enforce strict file-type checks.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
aviatrix aviatrix controller All versions
aviatrix controller >= 6.2, < 6.2.2043
>= 6.3, < 6.3.2490
>= 6.4, < 6.4.2838
>= 6.5, < 6.5.1922
cpe:2.3:a:aviatrix:controller:*:*:*:*:*:*:*:*
Original advisory text
Aviatrix Controller Unrestricted Upload of File
Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
References
Fix within
Internet-facing 3 days
and check for signs of compromise
Internal 3 days
and check for signs of compromise
  • Known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
93% chance of attack within 30 days
Type
CWE-23Relative Path Traversal
Timeline
Published13 Sep 2021
Updated30 Sep 2026
First seen6 Mar 2026
Sources
CVE-2021-40870 · CISA KEV
CVE-2021-40870 · NVD
Track software like this
Free during beta