Server-Side Request Forgery in Vasion Print Virtual Appliance and Application

CVE-2025-34225

What is CVE-2025-34225?

The Vasion Print Virtual Appliance and Application are affected by a server-side request forgery vulnerability, allowing unauthenticated access to the 'console_release' directory over the internet. This exposes numerous PHP scripts that construct URLs from user-supplied input, executing commands like 'curl_exec()' or 'file_get_contents()' without adequate validation. While some files attempt to mitigate SSRF risks through filter checks, these efforts are insufficient. As a result, this vulnerability permits unauthorized remote attackers to probe internal resources, leading to potential data exfiltration or lateral movement within the network.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References