CVE-2025-22217

CVE-2025-22217 is an unauthenticated blind SQL injection vulnerability (CWE-89) in Avi Load Balancer, part of affected VMware products. It allows attackers to inject specially crafted SQL queries due to improper input validation. The vulnerability has a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high severity with network accessibility, low attack complexity, no required privileges or user interaction, and significant confidentiality impact in a scoped environment.

A malicious user with network access to the Avi Load Balancer can exploit this vulnerability without authentication by sending crafted SQL queries, potentially gaining unauthorized access to the underlying database. This could enable extraction of sensitive data, though the impact is primarily on confidentiality with no direct integrity or availability effects noted.

The Broadcom security advisory confirms patches are available to remediate the issue in affected VMware products, following a private report to VMware. Security practitioners should review the advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25346 for patch details and affected versions.