Aviatrix Controller OS Command Injection (CVE-2024-50603)

Historical catalog analysis: CISA added this entry on January 16, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2024-50603 is an OS command injection vulnerability (CWE-78) affecting Aviatrix Controllers. The flaw allows an unauthenticated attacker to execute arbitrary code on the system by sending shell metacharacters through specific API parameters.

Exposure and applicability

The vulnerability is present in the /v1/api endpoint. Specifically, exposure exists when input is processed via the following paths:
* The cloud_type parameter within the list_flightpath_destination_instances function.
* The src_cloud_type parameter within the flightpath_connection_test function.

Infrastructure owners utilizing Aviatrix Controllers for cloud networking should identify if these API endpoints are reachable from untrusted networks, as no authentication is required to trigger the injection.

Remediation priorities

Our analysis suggests prioritizing remediation based on the accessibility of the Controller’s management interface. Because this vulnerability allows unauthenticated remote code execution, it represents a high-priority exposure risk.

1. Apply Vendor Mitigations: The primary corrective action is to apply mitigations according to official vendor instructions.
2. Asset Decommissioning: In scenarios where mitigations cannot be applied or are unavailable for the specific deployment version, the source indicates that discontinuing use of the product is a necessary alternative.
3. Network Segmentation: While not a replacement for patching, restricting access to the /v1/api endpoint to known, trusted administrative IPs could reduce the likelihood of exploitation by unauthenticated external actors.

How to validate remediation

Verification must go beyond a simple version check, as a deployed update does not inherently guarantee that the configuration is secure or that the mitigation was applied successfully across all controller instances.

• Configuration Audit: Confirm that the specific vendor-supplied mitigations have been implemented and verified against the current deployment architecture.
• Access Control Validation: Verify through network logs or firewall rules that the /v1/api endpoint is not exposed to the public internet or unauthorized internal segments.
• Functional Testing: In a non-production environment, security teams can verify if the API endpoints still accept shell metacharacters in the cloud_type and src_cloud_type fields. A successful mitigation should result in the API rejecting these inputs or treating them as literal strings rather than executable commands.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in known ransomware campaigns. Additionally, while CISA has provided a remediation deadline for federal agencies, this date is a regulatory requirement for those entities and not a technical expiration of the vulnerability’s risk for private organizations. Residual risk persists if the controller is managed via an insecure network path or if legacy versions are maintained without vendor-supported mitigations.

Source and editorial note

CVE-2024-50603: Aviatrix Controllers OS Command Injection Vulnerability · Source date: January 16, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: January 19, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 28, 2026 at 00:05 UTC.

Request a Vulnerability Assessment