🚨 Broadcom-owned VMware has disclosed multiple vulnerabilities in its Avi Load Balancer that let attackers bypass authentication and access backend databases. The most severe, CVE-2025-22217 (CVSS 8.6), is an unauthenticated blind SQL injection — a network-only attacker can send crafted SQL queries to sidestep login entirely and extract sensitive data. 🔹 Affects Avi Load Balancer 30.1.1–30.2.2; fixed in 30.1.2-2p2, 30.2.1-2p5 & 30.2.2-2p2 🔹 Compounded by privilege escalation (CVE-2024-22264) & plaintext credential leaks in logs (CVE-2024-22266) 🔹 No workarounds exist — patching is the only fix; 30.1.1 must upgrade to 30.1.2 first 🔹 No public PoC or active exploitation observed yet
Post summary
Broadcom's Avi Load Balancer suffers from multiple authentication bypass and blind SQL injection vulnerabilities, including CVE-2025-22217 (CVSS 8.6); patches are available but no exploitation has been observed yet.