CVE-2025-2172

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line…

Medium6.6EPSS 12.2%

Published: 23 Jun 2025
Updated: 26 Feb 2026
Reserved: 10 Mar 2025
Assigned by: Mandiant

Description

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames

Scores

CVSS scores of CVE-2025-2172, by who scored it
Scored by	CVSS	Score	Vector
MandiantCNA (assigner)	4.0	Medium6.6	CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
NVDNVD · Deferred	4.0	Medium6.6	CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 12.2% · top 3.8% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.6.

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)All about CWE-78 and its CVEs

Affected products

Aviatrix · Controller
- unaffected 7.1.4208
- unaffected 7.2.5090
- unaffected 8.0.0

References (2)

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0004.md (opens in a new tab)third-party-advisory
https://cloud.google.com/blog/topics/threat-intelligence/remote-code-execution-aviatrix-controller (opens in a new tab)technical-description

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-2172](https://trackcve.app/badge/CVE-2025-2172.svg)](https://trackcve.app/cve/CVE-2025-2172)

Record last updated 26 Feb 2026, 17:50 UTC.