Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2024-50603

An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.

CVSS 10.0 · CriticalBuzz score 47.6KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 47.6

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 16.1 · diversity 6.5 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
16.1
4 evidence mentions in the snapshot
Diversity score
6.5
2 sources across 1 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
4 source links · newest first
  • Security Affairs newsletter Round 507 by Pierluigi Paganini – INTERNATIONAL EDITIONSecurity Affairs

    A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. U.S. Treasury Sanctions Chinese cybersecurity firm and actor over federal agency breach tied to Salt Typhoon EU privacy […]

    newssecurityaffairs.comJan 19, 2025, 8:45 PM
  • U.S. CISA adds Aviatrix Controllers vulnerability to its Known Exploited Vulnerabilities catalogSecurity Affairs

    U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Aviatrix Controllers vulnerability to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical Aviatrix Controllers OS Command Injection vulnerability, tracked as CVE-2024-50603 (CVSS score of 10) to its Known Exploited Vulnerabilities (KEV) catalog. The flaw impacts Aviatrix Controller pre-7.1.4191 and 7.2.x […]

    newssecurityaffairs.comJan 17, 2025, 2:38 PM
  • Critical Aviatrix Controller Vulnerability Exploited Against Cloud EnvironmentsSecurityWeek

    Attackers are exploiting a critical vulnerability in Aviatrix Controller to execute arbitrary code in AWS cloud environments.

    newswww.securityweek.comJan 14, 2025, 10:46 AM
  • Threat actors exploit Aviatrix Controller flaw to deploy backdoors and cryptocurrency minersSecurity Affairs

    A critical vulnerability in Aviatrix Controller is actively exploited to deploy backdoors and cryptocurrency miners in the wild. A security researcher Jakub Korepta discovered a critical vulnerability, tracked as CVE-2024-50603 (CVSS score: 10.0), in the Aviatrix Controller. The flaw impacts Aviatrix Controller pre-7.1.4191 and 7.2.x pre-7.2.4996, it allows unauthenticated attackers to execute arbitrary code via improper command […]

    newssecurityaffairs.comJan 14, 2025, 10:23 AM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2026-73680

    Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute…

    CVSS 8.7 · High
    4 mentions
  • CVE-2026-17186

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command.

    CVSS 9.9 · Critical
    1 mention
  • CVE-2026-17179

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service due to command injection.

    CVSS 8.5 · High
    1 mention
  • CVE-2026-19188

    A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via…

    CVSS 10.0 · Critical
    3 mentions
  • CVE-2026-19682

    A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying opera…

    CVSS 9.4 · Critical
    1 mention
  • CVE-2026-19681

    An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted…

    CVSS 9.4 · Critical
    1 mention