← CVE catalog

CVE-2024-50603

Critical CVSS 10 Known exploited

Published 2025-01-08 · last changed 2026-06-17 · added to CISA KEV 2025-01-16

This one is being exploited in the wild.

CISA added CVE-2024-50603 to the Known Exploited Vulnerabilities catalog on 2025-01-16. Federal agencies are required to remediate it on a deadline. If you have affected machines, this is the class of finding that moves ahead of the rest of the queue.

The fix

We hold no Microsoft remediation data for CVE-2024-50603, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.

Sources

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H