CVE-2025-22217

High

Published: 28 January 2025

Published

28 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS Score 0.0024 47.6th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22217 is a high-severity SQL Injection (CWE-89) vulnerability in Broadcom (inferred from references). Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-22217 is an unauthenticated blind SQL injection vulnerability (CWE-89) in Avi Load Balancer, part of affected VMware products. It allows attackers to inject specially crafted SQL queries due to improper input validation. The vulnerability has a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high severity with network accessibility, low attack complexity, no required privileges or user interaction, and significant confidentiality impact in a scoped environment.

A malicious user with network access to the Avi Load Balancer can exploit this vulnerability without authentication by sending crafted SQL queries, potentially gaining unauthorized access to the underlying database. This could enable extraction of sensitive data, though the impact is primarily on confidentiality with no direct integrity or availability effects noted.

The Broadcom security advisory confirms patches are available to remediate the issue in affected VMware products, following a private report to VMware. Security practitioners should review the advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25346 for patch details and affected versions.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-2673

Vulnerability details

Avi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was privately reported to VMware. Patches are available to remediate this vulnerability in affected VMware products. A malicious user with network access may be able to use specially crafted…

SQL queries to gain database access.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Unauthenticated blind SQL injection in public-facing Avi Load Balancer enables direct exploitation of public-facing applications for initial access and database data extraction.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1