CVE-2025-2172

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input...

6.6 Medium

CVE-2025-2172 is a medium vulnerability (CVSS 6.6) in Aviatrix Controller, published June 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.2%, the 96th percentile. No source names a fixed version.

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

12.2%Up 11.9 points since Jun 24, 2025

What each source reports

CVE List Score used 6.6

Record: CVE-2025-2172
CVSS 4.0: 6.6 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weakness: CWE-78
Updated: 2026-11-02

EUVDEUVD-2025-18898 6.6

Record: EUVD-2025-18898
CVSS 4.0: 6.6 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Updated: 2026-11-02

GitHub AdvisoriesGHSA-wr65-2r27-crgw 7.5

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input...

Record: GHSA-wr65-2r27-crgw
CVSS 4.0: 7.5 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-78
Updated: 2026-11-02

NVD 6.6

Record: CVE-2025-2172
CVSS 4.0: 6.6 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-78
Updated: 2026-11-02

Affected products

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD