CVE-2021-40870

An unauthenticated user could upload a dangerous file to the Aviatrix Controller, leading to arbitrary code execution via directory traversal.

The Aviatrix Controller allowed unauthenticated users to upload files with dangerous types, enabling arbitrary code execution through directory traversal. This failure is critical for DIB organizations because it represents a severe, avoidable vulnerability that could lead to full system compromise and data breaches. Organizations should ensure all their cloud networking solutions are patched and monitored for similar upload vulnerabilities.

Shame score — The vulnerability allowed unauthenticated remote code execution, which is a severe, avoidable flaw that could have been exploited by any attacker without needing prior access.