Blind Server-Side Request Forgery in Vasion Print Virtual Appliance Host and Application

CVE-2025-34232

What is CVE-2025-34232?

The Vasion Print system, previously known as PrinterLogic, contains a blind server-side request forgery (SSRF) vulnerability that can be exploited by unauthenticated users. This flaw exists in the /var/www/app/console_release/lexmark/dellCheck.php script. The vulnerability arises from the lack of validation in URL requests generated by the system when a printer is registered. Specifically, the host name of the printer is incorporated into requests without appropriate filtering, allowing an attacker to probe internal services and trigger actions without direct visibility of the data. While the issue has been confirmed to be fixed, the timing of the patch's introduction remains uncertain.

References