🚨 Broadcom-owned VMware has disclosed multiple vulnerabilities in its Avi Load Balancer that let attackers bypass authentication and access backend databases. The most severe, CVE-2025-22217 (CVSS 8.6), is an unauthenticated blind SQL injection — a network-only attacker can send crafted SQL queries to sidestep login entirely and extract sensitive data. 🔹 Affects Avi Load Balancer 30.1.1–30.2.2; fixed in 30.1.2-2p2, 30.2.1-2p5 & 30.2.2-2p2 🔹 Compounded by privilege escalation (CVE-2024-22264) & plaintext credential leaks in logs (CVE-2024-22266) 🔹 No workarounds exist — patching is the only fix; 30.1.1 must upgrade to 30.1.2 first 🔹 No public PoC or active exploitation observed yet
Post summary
Broadcom’s VMware has disclosed several critical vulnerabilities in its Avi Load Balancer, including an unauthenticated blind SQL injection (CVE‑2025‑22217) and related privilege escalation flaws, with patches available but no public PoC or reported active exploitation.