Aviatrix Controllers OS Command Injection Vulnerability

概要

参考情報

• docs.aviatrix.com/documentation/latest/network-security/index.html · Product
• docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html · Vendor Advisory
• securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability · Exploit
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2024-50603

controller のその他の脆弱性

• CVE-2021-40870緊急 9.8悪用確認済み（CISA KEV）An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, wh…
• CVE-2020-27568高 7.5Insecure File Permissions exist in Aviatrix Controller 5.3.1516. Several world writable files and directories were found in the controller r…
• CVE-2020-26553緊急 9.8An issue was discovered in Aviatrix Controller before R6.0.2483. Several APIs contain functions that allow arbitrary files to be uploaded to…
• CVE-2020-26552高 7.5An issue was discovered in Aviatrix Controller before R6.0.2483. Multiple executable files, that implement API endpoints, do not require a v…
• CVE-2020-26551高 7.5An issue was discovered in Aviatrix Controller before R5.3.1151. Encrypted key values are stored in a readable file.