An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/164461/Aviatrix-Controller-6.x-Path-Traversal-Code-Execution.html | Exploit Third Party Advisory VDB Entry |
| https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html#security-note-9-11-2021 | Release Notes Vendor Advisory |
| https://wearetradecraft.com/advisories/tc-2021-0002/ | Exploit Third Party Advisory |
| http://packetstormsecurity.com/files/164461/Aviatrix-Controller-6.x-Path-Traversal-Code-Execution.html | Exploit Third Party Advisory VDB Entry |
| https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html#security-note-9-11-2021 | Release Notes Vendor Advisory |
| https://wearetradecraft.com/advisories/tc-2021-0002/ | Exploit Third Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40870 |
Configurations
Configuration 1 (hide)
|
History
22 Oct 2025, 00:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Oct 2025, 20:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Oct 2025, 19:19
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Nov 2024, 06:24
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/164461/Aviatrix-Controller-6.x-Path-Traversal-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html#security-note-9-11-2021 - Release Notes, Vendor Advisory | |
| References | () https://wearetradecraft.com/advisories/tc-2021-0002/ - Exploit, Third Party Advisory |
08 Aug 2023, 14:21
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-23 |
14 Dec 2021, 21:20
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) http://packetstormsecurity.com/files/164461/Aviatrix-Controller-6.x-Path-Traversal-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry |
11 Oct 2021, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
23 Sep 2021, 18:11
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-434 | |
| CPE | cpe:2.3:a:aviatrix:controller:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
| References | (MISC) https://wearetradecraft.com/advisories/tc-2021-0002/ - Exploit, Third Party Advisory | |
| References | (MISC) https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html#security-note-9-11-2021 - Release Notes, Vendor Advisory |
13 Sep 2021, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-09-13 08:15
Updated : 2025-10-22 00:17
NVD link : CVE-2021-40870
Mitre link : CVE-2021-40870
CVE.ORG link : CVE-2021-40870
JSON object : View
Products Affected
aviatrix
- controller
CWE
CWE-23
Relative Path Traversal