CVE-2025-34206criticalCWE-312CWE-732

CVE-2025-34206: falha crítica em Vasion Print Application (SaaS/VA)

Vasion Print (formerly PrinterLogic) Insecure Shared Storage Permissions

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Print Application+ Monitorar Print Virtual Appliance Host

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 0.5%
Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host configuration and secret material under /var/www/efs_storage into many Docker containers with overly-permissive filesystem permissions. Files such as secrets.env, GPG-encrypted blobs in .secrets, MySQL client keys, and application session files are accessible from multiple containers. An attacker who controls or reaches any container can read or modify these artifacts, leading to credential theft, RCE via Laravel APP_KEY, Portainer takeover, and full compromise.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Vasion · Print Application (SaaS/VA)Vasion · Print Virtual Appliance Host
CVEs relacionadas — Vasion Print Application (SaaS/VA)

No mesmo produto, das mais perigosas para as menos.

CVE-2025-34205CRITICALVasion Print (formerly PrinterLogic) Dangerous PHP Dead Code Enables RCEEPSS 1.5%CVE-2025-34221CRITICALVasion Print (formerly PrinterLogic)EPSS 1.5%CVE-2025-34223CRITICALVasion Print (formerly PrinterLogic) Insecure Installation CredentialsEPSS 1.2%CVE-2025-34215CRITICALVasion Print (formerly PrinterLogic) Unauthenticated Firmware Update Endpoint RCEEPSS 1.1%CVE-2025-34218CRITICALVasion Print (formerly PrinterLogic) Exposed Internal Docker InstanceEPSS 1.0%CVE-2025-34202HIGHVasion Print (formerly PrinterLogic) Insecure Access to Docker Instances WANEPSS 1.0%