CVE-2022-38368: Aviatrix Gateway

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated VPN user can inject arbitrary commands.

Affected products

• Aviatrix Gateway: before 6.6.5712 (fixed in 6.6.5712); from 6.7.0, before 6.7.1376 (fixed in 6.7.1376)

Published 2022-08-15. Last modified 2026-06-17.