CVE-2025-34222
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Vasion Print Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 expose four admin routes without authentication, allowing an unauthenticated attacker to upload, delete, or download TLS/SSL certificates and enumerate client IDs via an IDOR.
Risk Assessment
An attacker could replace the trusted root certificate, delete a certificate causing loss of trust, or download sensitive certificates, compromising communication security.
Recommendation
Update Vasion Print to Host 22.0.1049 and Application 20.0.2786 or later. Implement access control on administrative routes.
Other vulnerabilities in Vasion Print
See all- CVE-2025-34196Critical
Vasion Print Virtual Appliance Host prior to 25.1.102 and Application prior to 25.1.1413 (Windows client deployments) contain a hardcoded private key for the PrinterLogic CA and a hardcoded password in configuration files such as clientsettings.dat and defaults.ini. An attacker obtaining these files can impersonate the CA and perform man-in-the-middle attacks.
- CVE-2025-34206Critical
Vasion Print mounts host configuration and secret material under /var/www/efs_storage into many Docker containers with overly-permissive permissions, exposing files like secrets.env, GPG-encrypted blobs, MySQL client keys, and session files. An attacker with access to any container can read or modify these artifacts.
Original NVD description (English source)
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose four admin routes – /admin/hp/cert_upload, /admin/hp/cert_delete, /admin/certs/ca, and /admin/certs/serviceclients/{scid} – without any authentication check. The routes are defined in the /var/www/app/routes/web.php file inside the printercloud/pi Docker container and are handled by the HPCertificateController class, which performs no user validation. An unauthenticated attacker can therefore upload a new TLS/SSL certificate replacing the trusted root used by the appliance, delete an existing certificate causing immediate loss of trust for services that rely on it, or download any stored CA or client certificate via the service‑clients endpoint which also suffers an IDOR that allows enumeration of all client IDs. This vulnerability has been identified by the vendor as: V-2024-028 — Unauthenticated Admin APIs Used to Modify SSL Certificates.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS