CVE-2025-34220

Vasion Print Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 (VA/SaaS deployments) expose PHP scripts under the console_release directory without authentication. An unauthenticated remote attacker can invoke these endpoints to reconfigure networked printers, add or delete RFID badge devices, or modify device settings.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) contain a default admin account and an installation-time endpoint at /admin/query/update_database.php that can be accessed without authentication. An attacker who can reach the installation web interface can POST arbitrary root_user and root_password values, causing the script to replace the default admin credentials with attacker-controlled ones. The script also contains hard-coded SHA-512 and SHA-1 hashes of the default password, allowing bypass of password-policy validation. As a result, an unauthenticated remote attacker can obtain full administrative control of the system during initial setup.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 25.2.1518 (VA/SaaS deployments) expose every internal Docker container to the network because firewall rules allow unrestricted traffic to the Docker bridge network. Because no authentication, ACL or client-side identifier is required, an attacker can interact with any internal API, bypassing authentication mechanisms entirely. The result is unauthenticated remote access to internal services, allowing credential theft, configuration manipulation and potential remote code execution.

Vasion Print Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 (VA/SaaS deployments) expose internal Docker containers through the gw Docker instance. The /meta endpoint lists all microservice containers with version information, and these containers are reachable without ACL, authentication, or rate-limiting.

Vasion Print Virtual Appliance Host prior to 22.0.1026 and Application prior to 20.0.2702 (VA deployments only) expose unauthenticated REST API endpoints that return configuration files and clear-text passwords and disclose the Laravel APP_KEY used for cryptographic signing. Obtaining the APP_KEY allows an attacker to craft valid signed requests and achieve remote code execution.

Vasion Print Virtual Appliance Host prior to 22.0.1026 and Application prior to 20.0.2702 (VA deployments only) expose an unauthenticated firmware-upload flow. A public page returns a signed token, and every Docker image contains the appliance’s private GPG key and hard-coded passphrase, allowing attackers to decrypt, modify, re-sign, and upload malicious firmware for remote code execution.

Vasion Print Virtual Appliance Host before 22.0.843 and Application before 20.0.1923 have CI/CD weaknesses: the build pulls an unverified third-party image, downloads the VirtualBox Extension Pack over plain HTTP without signature validation, and grants the jenkins account NOPASSWD for mount/umount. This allows supply chain or man-in-the-middle compromise of the build pipeline, malicious firmware injection, and remote code execution as root on the CI host.

Vasion Print Virtual Appliance Host before 22.0.1049 and Application before 20.0.2786 configure the SSH client within Docker instances with UserKnownHostsFile=/dev/null, StrictHostKeyChecking=no, and ForwardAgent yes. These settings disable remote host key verification and automatically forward the developer's SSH-agent to any host matching wildcard patterns, allowing an attacker to capture forwarded private keys and use them for unrestricted lateral movement.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (VA and SaaS deployments) contain dangerous PHP dead code in multiple Docker-hosted PHP instances. A script named /var/www/app/resetroot.php lacks authentication checks and, when executed, performs a SQL update that sets the database administrator username to 'root' and its password hash to the SHA-512 hash of 'password'. Separately, commented-out code in /var/www/app/lib/common/oses.php would unserialize session data—a pattern that can enable remote code execution. An attacker able to reach resetroot.php can reset the MySQL root password and obtain full database control; combined with deserialization issues this can lead to full remote code execution and system compromise.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application contain multiple Docker containers running primary application processes (e.g., PHP workers, Node.js servers, custom binaries) as the root user. This increases the blast radius of a container compromise and enables lateral movement and host compromise.