Infoblox - SQLi (CVE-2025-32814)

CVE-2025-32814 is a vulnerability in Infoblox NETMRI affecting versions up to 7.6.1. This vulnerability allows unauthenticated SQL injection, potentially enabling remote attackers to execute arbitrary SQL commands against the application's database. Such an exploit could lead to unauthorized data access, data manipulation, or even full system compromise.

CrowdSec has been tracking this vulnerability and its exploits since 16th of July 2025.

CrowdSec network observations suggest that most exploitation of CVE-2025-32814 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2025-32814 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the unauthenticated SQL injection vulnerability by sending crafted requests to /netmri/config/userAdmin/login.tdf with malicious SQL payloads in the skipjackUsername parameter.