PT-2025-39888 · Unknown · Vasion Print+2

Pierre Barre · Published 2025-09-29 · Updated 2025-09-29 · CVE-2025-34223

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Vasion Print versions prior to 22.0.1049 Vasion Print Application versions prior to 20.0.2786

Description The Vasion Print Virtual Appliance Host and Application contain a default admin account and an installation-time endpoint at /admin/query/update database.php accessible without authentication. An attacker can POST arbitrary root user and root password values to this endpoint, replacing the default admin credentials with attacker-controlled ones. The script includes hard-coded SHA-512 and SHA-1 hashes of the default password, bypassing password policy validation. This allows an unauthenticated remote attacker to gain full administrative control of the system during initial setup.

Recommendations Update Vasion Print Virtual Appliance Host to version 22.0.1049 or later. Update Vasion Print Application to version 20.0.2786 or later.

Exploit

Fix

Missing Authentication

Using Hardcoded Credentials

Weakness Enumeration

CWE-306

CWE-798

Related Identifiers

CVE-2025-34223

Affected Products

Vasion Print

Vasion Print Application

Vasion Print Virtual Appliance Host

References · 7

• 🔥 https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-insecure-credentials-installation · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34223 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34223 · Vendor Advisory
• https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm · Patch, Vendor Advisory
• https://vulncheck.com/advisories/vasion-print-printerlogic-insecure-installation-credentials · Note
• https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm · Patch, Vendor Advisory
• https://twitter.com/CVEnew/status/1972765975981252668 · Twitter Post