Back to overview

CVE-2025-34216

CRITICAL Exploitation: PoC
10.0
CVSS 4.0
Description
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (VA deployments only) expose a set of unauthenticated REST API endpoints that return configuration files and clear‑text passwords. The same endpoints also disclose the Laravel APP_KEY used for cryptographic signing. Because the APP_KEY is required to generate valid signed requests, an attacker who obtains it can craft malicious payloads that are accepted by the application and achieve remote code execution on the appliance. This vulnerability has been identified by the vendor as: V-2024-018 — RCE & Leaks via API.

Metadata

CVE ID
CVE-2025-34216
State
PUBLISHED
Assigner
VulnCheck
Reserved
2025-04-15 19:15 UTC
Published
2025-09-29 20:39 UTC
Last updated
2026-05-15 11:15 UTC
Primary CWE
CWE-306
CWE-306 Missing Authentication for Critical Function
Vendor / Product
Vasion / Print Virtual Appliance Host
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
yes
Tech. Impact
total
Affected products (2)
VendorProductPlatformVersions
Vasion Print Application — 0 < 20.0.2702
Vasion Print Virtual Appliance Host — 0 < 22.0.1026
Weakness (CWE)
CWESourceDescription
CWE-306 cna CWE-306 Missing Authentication for Critical Function
CWE-312 cna CWE-312 Cleartext Storage of Sensitive Information
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L
References (4)
Back to overview