Aviatrix vulnerabilities
We track 4 vulnerabilities in Aviatrix products across 2 products. 4 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on June 23, 2025.
Latest Aviatrix vulnerabilities
- 7.8 High severity
Controller: Improper Restriction of Excessive Authentication Attempts
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN
- 9.8 Critical severity
Aviatrix Controllers OS Command Injection Exploited
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be s
- 8.8 High severity
Gateway: Improper Authentication
An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated VPN user can inject arbitrary commands.
- 9.8 Critical severity
Aviatrix Controller Unrestricted Upload of File Exploited
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.