🚨 Broadcom-owned VMware has disclosed multiple vulnerabilities in its Avi Load Balancer that let attackers bypass authentication and access backend databases. The most severe, CVE-2025-22217 (CVSS 8.6), is an unauthenticated blind SQL injection — a network-only attacker can send crafted SQL queries to sidestep login entirely and extract sensitive data. 🔹 Affects Avi Load Balancer 30.1.1–30.2.2; fixed in 30.1.2-2p2, 30.2.1-2p5 & 30.2.2-2p2 🔹 Compounded by privilege escalation (CVE-2024-22264) & plaintext credential leaks in logs (CVE-2024-22266) 🔹 No workarounds exist — patching is the only fix; 30.1.1 must upgrade to 30.1.2 first 🔹 No public PoC or active exploitation observed yet
Post summary
Broadcom-owned VMware disclosed several vulnerabilities in Avi Load Balancer, notably CVE‑2025‑22217, an unauthenticated blind SQL injection with CVSS 8.6. No public PoC or active exploitation has been reported, and patching is the only mitigation.
