{"id":"CVE-2025-2172","state":"PUBLISHED","title":"Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via","description":"Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames","publishedAt":"2025-06-23T14:01:19.310Z","updatedAt":"2026-02-26T17:50:27.223Z","severity":{"score":6.6,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","source":"Mandiant"},"assigner":"Mandiant","products":["Aviatrix Controller"],"affected":[{"vendor":"Aviatrix","product":"Controller","defaultStatus":"affected","versions":[{"version":"7.1.4208","status":"unaffected"},{"version":"7.2.5090","status":"unaffected"},{"version":"8.0.0","status":"unaffected"}]}],"references":["https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0004.md","https://cloud.google.com/blog/topics/threat-intelligence/remote-code-execution-aviatrix-controller"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:08:55.257Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/2xxx/CVE-2025-2172.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-2172","state":"PUBLISHED","datePublished":"2025-06-23T14:01:19.310Z","dateUpdated":"2026-02-26T17:50:27.223Z","assignerShortName":"Mandiant","assignerOrgId":"027e81ed-0dd4-4685-ab4d-884aec5bb484","dateReserved":"2025-03-10T16:18:09.651Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames"}],"affected":[{"vendor":"Aviatrix","product":"Controller","defaultStatus":"affected","versions":[{"version":"7.1.4208","status":"unaffected"},{"version":"7.2.5090","status":"unaffected"},{"version":"8.0.0","status":"unaffected"}]}],"references":[{"url":"https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0004.md","tags":["third-party-advisory"]},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/remote-code-execution-aviatrix-controller","tags":["technical-description"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","exploitMaturity":"PROOF_OF_CONCEPT","baseScore":6.6,"baseSeverity":"MEDIUM","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Mandiant","orgId":"027e81ed-0dd4-4685-ab4d-884aec5bb484","dateUpdated":"2025-06-23T18:04:09.203Z"},"impacts":[{"capecId":"CAPEC-88","descriptions":[{"lang":"en","value":"CAPEC-88 OS Command Injection"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-2172","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-06-24T03:55:36.333136Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-26T17:50:27.223Z"}}]}}}