CVE-2025-2171CWE-307

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute…

High · published June 23, 2025

CVSS v4.0
7.8
EPSS
0%
Percentile
40.2
In the wild
Unconfirmed
What it is

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN

The record
Technical detail
CVSS v4.0
7.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00477 · 40.2th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2025-06-23T14:01Z
EPSS history
Timeline
  • 23 JUN 14:01Z
    Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute…
    cvelistv5