Vasion Print Virtual Appliance vulnerabilities

Vasion Print Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 (VA/SaaS deployments) expose PHP scripts under the console_release directory without authentication. An unauthenticated remote attacker can invoke these endpoints to reconfigure networked printers, add or delete RFID badge devices, or modify device settings.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) contain a default admin account and an installation-time endpoint at /admin/query/update_database.php that can be accessed without authentication. An attacker who can reach the installation web interface can POST arbitrary root_user and root_password values, causing the script to replace the default admin credentials with attacker-controlled ones. The script also contains hard-coded SHA-512 and SHA-1 hashes of the default password, allowing bypass of password-policy validation. As a result, an unauthenticated remote attacker can obtain full administrative control of the system during initial setup.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 25.2.1518 (VA/SaaS deployments) expose every internal Docker container to the network because firewall rules allow unrestricted traffic to the Docker bridge network. Because no authentication, ACL or client-side identifier is required, an attacker can interact with any internal API, bypassing authentication mechanisms entirely. The result is unauthenticated remote access to internal services, allowing credential theft, configuration manipulation and potential remote code execution.

Vasion Print Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 (VA/SaaS deployments) expose internal Docker containers through the gw Docker instance. The /meta endpoint lists all microservice containers with version information, and these containers are reachable without ACL, authentication, or rate-limiting.

Vasion Print Virtual Appliance Host prior to 22.0.1026 and Application prior to 20.0.2702 (VA deployments only) expose unauthenticated REST API endpoints that return configuration files and clear-text passwords and disclose the Laravel APP_KEY used for cryptographic signing. Obtaining the APP_KEY allows an attacker to craft valid signed requests and achieve remote code execution.

Vasion Print Virtual Appliance Host prior to 22.0.1026 and Application prior to 20.0.2702 (VA deployments only) expose an unauthenticated firmware-upload flow. A public page returns a signed token, and every Docker image contains the appliance’s private GPG key and hard-coded passphrase, allowing attackers to decrypt, modify, re-sign, and upload malicious firmware for remote code execution.

Vasion Print Virtual Appliance Host before 22.0.843 and Application before 20.0.1923 have CI/CD weaknesses: the build pulls an unverified third-party image, downloads the VirtualBox Extension Pack over plain HTTP without signature validation, and grants the jenkins account NOPASSWD for mount/umount. This allows supply chain or man-in-the-middle compromise of the build pipeline, malicious firmware injection, and remote code execution as root on the CI host.

Vasion Print Virtual Appliance Host before 22.0.1049 and Application before 20.0.2786 configure the SSH client within Docker instances with UserKnownHostsFile=/dev/null, StrictHostKeyChecking=no, and ForwardAgent yes. These settings disable remote host key verification and automatically forward the developer's SSH-agent to any host matching wildcard patterns, allowing an attacker to capture forwarded private keys and use them for unrestricted lateral movement.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (VA and SaaS deployments) contain dangerous PHP dead code in multiple Docker-hosted PHP instances. A script named /var/www/app/resetroot.php lacks authentication checks and, when executed, performs a SQL update that sets the database administrator username to 'root' and its password hash to the SHA-512 hash of 'password'. Separately, commented-out code in /var/www/app/lib/common/oses.php would unserialize session data—a pattern that can enable remote code execution. An attacker able to reach resetroot.php can reset the MySQL root password and obtain full database control; combined with deserialization issues this can lead to full remote code execution and system compromise.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application contain multiple Docker containers running primary application processes (e.g., PHP workers, Node.js servers, custom binaries) as the root user. This increases the blast radius of a container compromise and enables lateral movement and host compromise.

Vasion Print Virtual Appliance Host versions prior to 22.0.1002 and Application prior to 20.0.2614 contain multiple Docker containers with outdated, unsupported, or vulnerable third-party components such as Nginx 1.17.x, OpenSSL 1.1.1d, and EOL base images and Laravel/PHP libraries. This increases the attack surface and enables exploitation chains.

Vasion Print Virtual Appliance Host versions prior to 22.0.951 and Application prior to 20.0.2368 (VA and SaaS deployments) contain shared, hardcoded SSH host private keys (RSA, ECDSA, ED25519) in the appliance image. The same keys are present across installations, allowing an attacker to impersonate the appliance and perform man-in-the-middle attacks on administrative SSH sessions.

Vasion Print Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (Windows client deployments) contain a remote code execution vulnerability during driver installation due to unquoted program paths. The PrinterInstallerClient launches programs using an unquoted path, allowing execution of a program at a short-path location such as C:\Program.exe.

Vasion Print Virtual Appliance Host versions prior to 22.0.893 and Application prior to 20.0.2140 (macOS/Linux client deployments) are built against OpenSSL 1.0.2h-fips, which has been end-of-life since 2019. Continued use of this outdated cryptographic library exposes deployments to known, unpatched vulnerabilities.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application store user passwords using unsalted SHA-512 hashes with a fall-back to unsalted SHA-1. Hashing is performed via PHP's hash() function in multiple files, with no per-user salt, and the fast hash algorithms are unsuitable for password storage. An attacker who obtains the password database can recover cleartext passwords via offline dictionary or rainbow table attacks.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 contain a blind and non-blind server-side request forgery (SSRF) vulnerability. The /var/www/app/console_release/hp/badgeSetup.php script is reachable from the internet without authentication and builds URLs from user-controlled parameters without whitelist, scheme restriction, IP-range validation, or outbound-network filtering.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 contain a server-side request forgery (SSRF) vulnerability. The /var/www/app/console_release/lexmark/update.php script is reachable from the internet without authentication and builds URLs from user-controlled values before invoking curl_exec() or file_get_contents() without proper validation.

Vasion Print Virtual Appliance Host prior to 25.1.102 and Application prior to 25.1.1413 contain an SSRF vulnerability. The console_release directory is reachable from the internet without authentication, and PHP scripts build URLs from user-controlled values and invoke curl_exec() or file_get_contents() without proper validation.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.862 and Application prior to 20.0.2014 (VA and SaaS deployments) contain Docker images with the private GPG key and passphrase for the account [email protected]. The key is stored in cleartext and the passphrase is hardcoded in files. An attacker with administrative access to the appliance can extract the private key, import it into their own system, and subsequently decrypt GPG-encrypted files and sign arbitrary firmware update packages. A maliciously signed update can be uploaded by an admin-level attacker and will be executed by the appliance, giving the attacker full control of the virtual appliance.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518 (VA and SaaS deployments) expose Docker internal networks, allowing an attacker on the same external L2 segment or one able to add routes using the appliance as a gateway to reach container IPs directly. This grants access to internal services (HTTP APIs, Redis, MySQL, etc.) intended to be isolated within the container network, many of which are accessible without authentication or vulnerable to known exploitation chains.

Vasion Print (formerly PrinterLogic) Virtual Appliance contains insecure defaults and code patterns that disable TLS/SSL certificate verification for communications to printers and internal microservices. As a result, the client accepts TLS connections without validating server certificates, enabling man-in-the-middle attacks.