CVE-2021-40870

Timeline

Detection, updates, and resolution for this record.

1. Sep 13, 2021 · Catalog

   Detected

   An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.

2. Jan 18, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Feb 1, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.

Affected

• cpe aviatrix/controllerversion unspecified
• vendor Aviatrix Aviatrix Controllerversion unspecified

Sources

• CISA KEVCVE-2021-40870

  Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.

  cisa.gov
• CVE.orgCVE-2021-40870

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2021-40870

  30-day exploitation probability 93.0%

  first.org
• NIST NVDCVE-2021-40870

  An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.

  nvd.nist.gov
• Packet Storm Securityhttp://packetstormsecurity.com/files/164461/Aviatrix-Controller-6.x-Path-Traversal-Code-Execution.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com

References

• Exploit · packetstormsecurity.com
• Release Notes · docs.aviatrix.com
• CISA note · nvd.nist.gov
• Exploit · wearetradecraft.com
• US Government Resource · cisa.gov