Insecure Password Hashing in Vasion Print Virtual Appliance by PrinterLogic
CVE-2025-34208
Key Information:
- Vendor
Vasion
- Vendor
- CVE Published:
- 2 October 2025
What is CVE-2025-34208?
Vasion Print, a product by PrinterLogic, has a notable vulnerability due to the use of unsalted SHA-512 hashes for storing user passwords. The hashing mechanism involves a fallback to unsalted SHA-1, utilizing PHP's hash() function across various scripts. This approach lacks per-user salting, making passwords susceptible to offline attacks, including dictionary and rainbow table methods. Furthermore, the migration logic for legacy SHA-1 hashes to SHA-512 during user login hinders the security posture, potentially exposing users still relying on outdated hashing algorithms. While partial mitigations have been applied, significant vulnerabilities remain, particularly in the legacy authentication framework.
Affected Version(s)
Print Application *
Print Virtual Appliance Host *