Unauthenticated Remote Access Vulnerability in Vasion Print Virtual Appliance
CVE-2025-34224

10CRITICAL

Key Information:

Vendor

Vasion

Status
Print Virtual Appliance Host
Print Application
Vendor
CVE Published:
29 September 2025

What is CVE-2025-34224?

The Vasion Print Virtual Appliance and Application prior to specific versions expose unsecured PHP scripts in the console_release directory. This lack of authentication allows remote attackers to exploit these scripts, potentially enabling them to reconfigure networked printers, and manage associated devices such as RFID badge readers, without any authentication. As a result, attackers can carry out unauthorized modifications to critical printer settings, leading to significant operational disruptions and security risks.

Affected Version(s)

Print Application * < 20.0.2786

Print Virtual Appliance Host * < 22.0.1049

References

https://pierrekim.github.io/blog/2025-04-08-vasion-printe...
technical-description
https://help.printerlogic.com/va/Print/Security/Security-...
vendor-advisorypatch
https://help.printerlogic.com/saas/Print/Security/Securit...
vendor-advisorypatch

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pierre Barre
JSON
.
CVE-2025-34224 : Unauthenticated Remote Access Vulnerability in Vasion Print Virtual Appliance