ACTIVELY EXPLOITED
CVE-2021-40870: Aviatrix Controller Unrestricted Upload of File
| Vendor | Aviatrix |
|---|---|
| Product | Aviatrix Controller |
| Actively exploited | Yes |
| Added to CISA KEV | 18 Jan 2022 |
| CISA federal deadline | 1 Feb 2022 |
| Weakness (CWE) | CWE-25, CWE-96 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
SOURCES
Other Aviatrix flaws
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.