Paper/Archive/CVE-2025-34224

CVE-2025-34224

Vasion Print Virtual Appliance Host — Vasion Print (formerly PrinterLogic) Unauthenticated Device Modification

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 61.8.618 × 2012.4 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose a set of PHP scripts under the `console_release` directory without requiring authentication. An unauthenticated remote attacker can invoke these endpoints to re‑configure networked printers, add or delete RFID badge devices, or otherwise modify device settings. This vulnerability has been identified by the vendor as: V-2024-029 — No Authentication to Modify Devices.

Affected

ProductAffectedFixed inSource

Print Virtual Appliance Host< 22.0.104922.0.1049CNA

Print Application< 20.0.278620.0.2786CNA

Scores by source

VulnCheck (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitpierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-lack-of-auth-manage-printers patchhelp.printerlogic.com/va/Print/Security/Security-Bulletins.htm patchhelp.printerlogic.com/saas/Print/Security/Security-Bulletins.htm writeupvulncheck.com/advisories/vasion-print-printerlogic-unauth-device-modification