PT-2025-38610 · Vasion · Vasion Print Application+1

Pierre Barre

·

Published

2025-09-19

·

Updated

2025-09-20

·

CVE-2025-34205

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Vasion Print Virtual Appliance Host versions prior to 22.0.843 Vasion Print Application versions prior to 20.0.1923
Description Vasion Print contains dangerous PHP dead code in multiple Docker-hosted PHP instances. A script located at /var/www/app/resetroot.php lacks authentication checks and, when executed, performs a SQL update that sets the database administrator username to root and its password hash to the SHA-512 hash of the string password. Commented-out code in /var/www/app/lib/common/oses.php would unserialize session data (unserialize($ SESSION['osdata']))—a pattern that can enable remote code execution if re-enabled or reached with attacker-controlled serialized data. An attacker able to reach the resetroot.php endpoint can reset the MySQL root password and obtain full database control, potentially leading to full remote code execution and system compromise.
Recommendations Vasion Print Virtual Appliance Host versions prior to 22.0.843 should be updated to version 22.0.843 or later. Vasion Print Application versions prior to 20.0.1923 should be updated to version 20.0.1923 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-561

Related Identifiers

BDU:2026-00334
CVE-2025-34205

Affected Products

Vasion Print Application
Vasion Print Virtual Appliance Host