CVE-2021-40870VulnerabilityPublished 01/18/2022Updated 10/24/2026

CVE-2021-40870: Aviatrix Controller Unrestricted Upload of File

Affects Aviatrix Aviatrix ControllerSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 01/18/2022
KEV deadline: 02/01/2022
EPSS: 93.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-40870 (opens in a new tab)

Description

CVE-2021-40870 is a vulnerability in Aviatrix Controller that allows unauthenticated attackers to upload files with dangerous types without restriction. This can lead to arbitrary code execution through directory traversal techniques. The vulnerability has been exploited in the wild and is considered high severity.

Summary

The Aviatrix Controller suffers from an unrestricted file upload vulnerability (CVE-2021-40870) that permits unauthenticated users to upload files with dangerous types. This flaw enables attackers to execute arbitrary code by leveraging directory traversal to place malicious files in unintended locations. The vulnerability is associated with CWE-25 (Path Traversal) and CWE-96 (Improper Control of Filename for Include/Require Statement in PHP Program). Exploitation has been observed in the wild, indicating active threat usage.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary code on the affected Aviatrix Controller system. This can lead to full system compromise, unauthorized access, and potential disruption of network management functions.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Aviatrix Controller interface and monitor for suspicious file upload activity. Follow any vendor recommendations once published.

CVE-2021-40870: Aviatrix Controller Unrestricted Upload of File

What to do

Description

Summary

Impact

Mitigation

Weaknesses

References

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:57:14 UTC

Weaknesses

References

Related threats