CVE-2025-41233VulnerabilityPublished 12 Jun 2025

CVE-2025-41233: VMware Avi Load Balancer · SQL Injection

Affects VMware Avi Load BalancerSource CVE Database V5

Not known to be exploited · CVSS 6.8 Medium.

Data as of 26 Oct 2026, 06:26 UTC

CVSS 3.1 base score

6.8Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.3% chance of exploitation in 30 days – higher than 25% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: High
User Interaction: None
Scope: Changed
Confidentiality: High
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: High: The attacker is authorized with (i.e., requires) privileges that provide significant (e.g., administrative) control over the vulnerable component that could affect component-wide settings and files.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Changed: An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 12 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
VMware Avi Load Balancer	Affected =30.1.1 =30.1.2 =30.2.1 =30.2.2 =31.1.1	Fixed in–

AI-suggested

1. Immediate application of VMware's official patches to affected Avi Load Balancer versions is critical. Ensure all instances running vulnerable versions (30.1.1, 30.1.2, 30.2.1, 30.2.2, and 31.1.1) are updated to the fixed versions (e.g., 30.1.2-2p3, 30.2.1-2p6, 30.2.2-2p5, 31.1.1-2p2). 2. Restrict administrative and authenticated access to the Avi Load Balancer management interfaces to trusted networks and users only, employing network segmentation and zero-trust principles. 3. Implement strong multi-factor authentication (MFA) for all users with access to the load balancer to reduce the risk of credential compromise. 4. Conduct regular audits of user accounts and permissions on the Avi Load Balancer to ensure least privilege principles are enforced. 5. Monitor logs for unusual or suspicious SQL query patterns or database access attempts that could indicate exploitation attempts. 6. Employ Web Application Firewalls (WAFs) or database activity monitoring tools capable of detecting and blocking anomalous SQL injection patterns, tailored specifically for the Avi Load Balancer environment. 7. Develop and test incident response plans that include scenarios involving SQL injection attacks on network infrastructure components. 8. Coordinate with VMware support for any additional security advisories or updates related to this vulnerability. These targeted actions go beyond generic patching advice by emphasizing access control hardening, monitoring, and proactive detection tailored to the specific nature of this vulnerability.

Description

Description: VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability. VMware has evaluated the severity of the issue to be in the Moderate severity range https://www.broadcom.com/support/vmware-services/security-response with a maximum CVSSv3 base score of 6.8 https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N . Known Attack Vectors: An authenticated malicious user with network access may be able to use specially crafted SQL queries to gain database access. Resolution: To remediate CVE-2025-41233 apply the patches to the Avi Controller listed in the 'Fixed Version' column of the 'Response Matrix' found below. Workarounds: None. Additional Documentation: None. Acknowledgements: VMware would like to thank Alexandru Copaceanu https://www.linkedin.com/in/alexandru-copaceanu-b39aaa1a8/ for reporting this issue to us. Notes: None. Response Matrix: ProductVersionRunning OnCVECVSSv4SeverityFixed VersionWorkaroundsAdditional DocumentsVMware Avi Load Balancer30.1.1AnyCVE-2025-41233 6.8 https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N Moderate 30.1.2-2p3 https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-1/vmware-avi-load-balancer-release-notes/release-notes-30-1-2.html NoneNoneVMware Avi Load Balancer30.1.2AnyCVE-2025-41233 6.8 https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N Moderate 30.1.2-2p3 https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-1/vmware-avi-load-balancer-release-notes/release-notes-30-1-2.html NoneNoneVMware Avi Load Balancer30.2.1AnyCVE-2025-41233 6.8 https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N Moderate 30.2.1-2p6 https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-2/vmware-avi-load-balancer-release-notes/release-notes-for-avi-load-balancer-version-30-2-1.html NoneNoneVMware Avi Load Balancer30.2.2AnyCVE-2025-41233 6.8 https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N Moderate 30.2.2-2p5 https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-2/vmware-avi-load-balancer-release-notes/release-notes-for-avi-load-balancer-version-30-2-2.html NoneNoneVMware Avi Load Balancer30.2.3AnyCVE-2025-41233N/AN/AUnaffectedNoneNoneVMware Avi Load Balancer31.1.1AnyCVE-2025-41233 6.8 https://www.first.org/cvss/calculator/3-0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N Moderate 31.1.1-2p2 https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/31-1/vmware-avi-load-balancer-release-notes/Release-Note-Section-20627.html NoneNone CWE-89 in the Avi Load Balancer component of VMware allows an authenticated attacker to execute blind SQL injections in versions 30.1.1, 30.1.2, 30.2.1, and 30.2.2 due to improper input validation, enabling unauthorized database access.

Impact

For European organizations, the impact of CVE-2025-41233 can be significant, especially for those relying on VMware Avi Load Balancer for critical network traffic management and application delivery. Unauthorized database access could expose sensitive configuration data, user credentials, or operational details, potentially facilitating further attacks such as privilege escalation or lateral movement within corporate networks. Confidentiality breaches could lead to compliance violations under GDPR, resulting in legal and financial penalties. The vulnerability does not directly affect data integrity or availability, but the exposure of sensitive information could indirectly compromise system security and trustworthiness. Organizations in sectors with high regulatory requirements, such as finance, healthcare, and government, are particularly at risk. Additionally, the requirement for authenticated access means insider threats or compromised credentials could be leveraged to exploit this vulnerability. The absence of workarounds increases the urgency for patching to prevent exploitation. Although no known exploits are currently reported in the wild, the moderate severity and potential for data leakage necessitate proactive mitigation to avoid future targeted attacks.

Summary

CVE-2025-41233 is an authenticated blind SQL Injection vulnerability identified in VMware Avi Load Balancer versions 30.1.1, 30.1.2, 30.2.1, 30.2.2, and 31.1.1. The vulnerability arises due to improper neutralization of special elements used in SQL commands (CWE-89), allowing an attacker with valid authentication and network access to craft malicious SQL queries that can be executed against the backend database. This flaw enables unauthorized disclosure of sensitive database information, impacting confidentiality without affecting data integrity or availability. The vulnerability is classified as moderate severity with a CVSS v3.1 base score of 6.8, reflecting that exploitation requires high privileges (authenticated user) but no user interaction and low attack complexity. The scope is considered changed (S:C), indicating that the vulnerability can affect resources beyond the initially vulnerable component. Exploitation does not require UI interaction but does require network access and valid credentials, limiting the attack surface to authenticated users. VMware has released patches in versions 30.1.2-2p3, 30.2.1-2p6, 30.2.2-2p5, and 31.1.1-2p2 to remediate this issue. No workarounds are available. The vulnerability allows attackers to perform blind SQL injection, which can be used to extract sensitive data from the database, potentially including credentials, configuration details, or other critical information stored by the load balancer. Given the role of Avi Load Balancer in managing and distributing network traffic, compromise of its database confidentiality could lead to further lateral movement or targeted attacks within an organization's infrastructure.

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #2OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Parameterization
If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated.
Architecture and Design · Operation · Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment.
OWASP Cheat Sheets
Query Parameterization (opens in a new tab)
Unvalidated Redirects and Forwards (opens in a new tab)
XML Security (opens in a new tab)
XML External Entity Prevention (opens in a new tab)
File Upload (opens in a new tab)
OWASP ASVS 4.0.3
V5.3.4 (opens in a new tab)
V5.3.5 (opens in a new tab)
V1.5.1 (opens in a new tab)
Attack patterns
Command Line Execution through SQL Injection (opens in a new tab)
Object Relational Mapping Injection (opens in a new tab)
SQL Injection through SOAP Parameter Tampering (opens in a new tab)
Expanding Control over the Operating System from the Database (opens in a new tab)
SQL Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25707 (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Jun 2025, 22:08 UTC

WeaknessesCWE-89

Technical details

References

Community reviews

Related threats