VMware Avi Load Balancer: remote code execution on the Avi Controller control plane

Impact

An attacker who can reach the Avi Controller can execute code on it. The Controller is the policy brain for every virtual service it fronts, so code execution there means the attacker can rewrite pools, certificates and health checks for the inference and API endpoints published through the load balancer, and can read the TLS material the Controller holds. On a GPU fleet the load balancer is usually the single ingress path in front of shared model-serving pools, so a compromised Controller lets traffic for one tenant be silently steered or mirrored. The record does not describe the flaw class beyond remote code execution; Broadcom's advisory is the only detail available.

Who can reach it

Network access to the Avi Controller. The description says 'a malicious user with network access', while the CVSS vector records PR:L - treat it as reachable by anyone who can talk to the Controller's management interface, with at most low-privileged credentials.

What to do

Upgrade the Controller to the fixed release for your train: 32.1.2, 31.2.2-2p3, or 30.2.7 (22.1.x also moves to 30.2.7). This is a Controller software upgrade and management-plane restart, not a data-path change, so plan a management maintenance window; the advisory does not state whether Service Engines need a separate upgrade. All four flaws in this advisory are fixed by the same releases, so patch once. Until then, restrict Controller reachability to the management VLAN.

References