PT-2025-39895 · Printerlogic · Vasion Print Application+1
Pierre Barre
·
Publicado
2025-09-29
·
Atualizado
2025-09-30
·
CVE-2025-34232
CVSS v4.0
6.9
Média
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102
Vasion Print (formerly PrinterLogic) Application versions prior to 25.1.1413
Description
The software contains a blind server-side request forgery (SSRF) issue reachable via the
/var/www/app/console release/lexmark/dellCheck.php script. An unauthenticated user can exploit this issue. The software stores a printer’s host name in the printer vo->str host address variable and then builds a URL to send a request using curl without any validation, whitelisting, or private-network filtering. An attacker can probe internal services, trigger internal actions, or gather intelligence.Recommendations
Update Vasion Print Virtual Appliance Host to version 25.1.102 or later.
Update Vasion Print Application to version 25.1.1413 or later.
Exploit
Correção
Missing Authentication
SSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Vasion Print Application
Vasion Print Virtual Appliance Host