CVE-2025-34202
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518 (VA and SaaS deployments) expose Docker internal networks, allowing an attacker on the same external L2 segment or one able to add routes using the appliance as a gateway to reach container IPs directly. This grants access to internal services (HTTP APIs, Redis, MySQL, etc.) intended to be isolated within the container network, many of which are accessible without authentication or vulnerable to known exploitation chains.
Risk Assessment
A network-adjacent attacker can reach internal container services, enabling lateral movement, remote code execution, data exfiltration, and full system compromise. A single reachable endpoint can lead to compromise of the entire environment.
Recommendation
Update Vasion Print Virtual Appliance Host to version 25.2.169 or later and Application to version 25.2.1518 or later. Until patched, restrict network access to the appliance and segment the network to prevent access to internal Docker networks.
Other vulnerabilities in Vasion Print Virtual Appliance
See all- CVE-2025-34224Critical
Vasion Print Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 (VA/SaaS deployments) expose PHP scripts under the console_release directory without authentication. An unauthenticated remote attacker can invoke these endpoints to reconfigure networked printers, add or delete RFID badge devices, or modify device settings.
- CVE-2025-34223Critical
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) contain a default admin account and an installation-time endpoint at /admin/query/update_database.php that can be accessed without authentication. An attacker who can reach the installation web interface can POST arbitrary root_user and root_password values, causing the script to replace the default admin credentials with attacker-controlled ones. The script also contains hard-coded SHA-512 and SHA-1 hashes of the default password, allowing bypass of password-policy validation. As a result, an unauthenticated remote attacker can obtain full administrative control of the system during initial setup.
- CVE-2025-34221Critical
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 25.2.1518 (VA/SaaS deployments) expose every internal Docker container to the network because firewall rules allow unrestricted traffic to the Docker bridge network. Because no authentication, ACL or client-side identifier is required, an attacker can interact with any internal API, bypassing authentication mechanisms entirely. The result is unauthenticated remote access to internal services, allowing credential theft, configuration manipulation and potential remote code execution.
- CVE-2025-34218Critical
Vasion Print Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 (VA/SaaS deployments) expose internal Docker containers through the gw Docker instance. The /meta endpoint lists all microservice containers with version information, and these containers are reachable without ACL, authentication, or rate-limiting.
- CVE-2025-34216Critical
Vasion Print Virtual Appliance Host prior to 22.0.1026 and Application prior to 20.0.2702 (VA deployments only) expose unauthenticated REST API endpoints that return configuration files and clear-text passwords and disclose the Laravel APP_KEY used for cryptographic signing. Obtaining the APP_KEY allows an attacker to craft valid signed requests and achieve remote code execution.
- CVE-2025-34215Critical
Vasion Print Virtual Appliance Host prior to 22.0.1026 and Application prior to 20.0.2702 (VA deployments only) expose an unauthenticated firmware-upload flow. A public page returns a signed token, and every Docker image contains the appliance’s private GPG key and hard-coded passphrase, allowing attackers to decrypt, modify, re-sign, and upload malicious firmware for remote code execution.
- CVE-2025-34212Critical
Vasion Print Virtual Appliance Host before 22.0.843 and Application before 20.0.1923 have CI/CD weaknesses: the build pulls an unverified third-party image, downloads the VirtualBox Extension Pack over plain HTTP without signature validation, and grants the jenkins account NOPASSWD for mount/umount. This allows supply chain or man-in-the-middle compromise of the build pipeline, malicious firmware injection, and remote code execution as root on the CI host.
- CVE-2025-34207Critical
Vasion Print Virtual Appliance Host before 22.0.1049 and Application before 20.0.2786 configure the SSH client within Docker instances with UserKnownHostsFile=/dev/null, StrictHostKeyChecking=no, and ForwardAgent yes. These settings disable remote host key verification and automatically forward the developer's SSH-agent to any host matching wildcard patterns, allowing an attacker to capture forwarded private keys and use them for unrestricted lateral movement.
- CVE-2025-34205Critical
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (VA and SaaS deployments) contain dangerous PHP dead code in multiple Docker-hosted PHP instances. A script named /var/www/app/resetroot.php lacks authentication checks and, when executed, performs a SQL update that sets the database administrator username to 'root' and its password hash to the SHA-512 hash of 'password'. Separately, commented-out code in /var/www/app/lib/common/oses.php would unserialize session data—a pattern that can enable remote code execution. An attacker able to reach resetroot.php can reset the MySQL root password and obtain full database control; combined with deserialization issues this can lead to full remote code execution and system compromise.
- CVE-2025-34204Critical
Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application contain multiple Docker containers running primary application processes (e.g., PHP workers, Node.js servers, custom binaries) as the root user. This increases the blast radius of a container compromise and enables lateral movement and host compromise.
Original NVD description (English source)
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518 (VA and SaaS deployments) expose Docker internal networks in a way that allows an attacker on the same external L2 segment — or an attacker able to add routes using the appliance as a gateway — to reach container IPs directly. This grants access to internal services (HTTP APIs, Redis, MySQL, etc.) that are intended to be isolated inside the container network. Many of those services are accessible without authentication or are vulnerable to known exploitation chains. As a result, compromise of a single reachable endpoint or basic network access can enable lateral movement, remote code execution, data exfiltration, and full system compromise. This vulnerability has been identified by the vendor as: V-2025-003 — Insecure Access to Docker Instance from WAN.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS