CVE-2025-2171 Security feature bypass in Controller
Attackers can brute force 6-digit password reset PINs due to missing rate limiting, potentially taking over accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-2171?
CVE-2025-2171 is a high-severity vulnerability in Aviatrix Controller, published on 23 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN
Weakness: CWE-307
Which versions are affected by CVE-2025-2171?
How do I fix CVE-2025-2171?
No fix has been published for CVE-2025-2171 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-2171 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-2171 exists.
Sources
Also known as GHSA-fhf7-g3jp-w7f7.