CVE-2025-34215criticalCWE-306CWE-321

CVE-2025-34215: falha crítica em Vasion Print Application

Vasion Print (formerly PrinterLogic) Unauthenticated Firmware Update Endpoint RCE

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Print Application+ Monitorar Print Virtual Appliance Host

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.4epss 1.1%
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (only VA deployments) expose an unauthenticated firmware-upload flow: a public page returns a signed token usable at va-api/v1/update, and every Docker image contains the appliance’s private GPG key and hard-coded passphrase. An attacker who extracts the key and obtains a token can decrypt, modify, re-sign, upload, and trigger malicious firmware, gaining remote code execution. This vulnerability has been identified by the vendor as: V-2024-020 — Remote Code Execution.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
Vasion · Print ApplicationVasion · Print Virtual Appliance Host
CVEs relacionadas — Vasion Print Application

No mesmo produto, das mais perigosas para as menos.

CVE-2025-34205CRITICALVasion Print (formerly PrinterLogic) Dangerous PHP Dead Code Enables RCEEPSS 1.5%CVE-2025-34221CRITICALVasion Print (formerly PrinterLogic)EPSS 1.5%CVE-2025-34223CRITICALVasion Print (formerly PrinterLogic) Insecure Installation CredentialsEPSS 1.2%CVE-2025-34218CRITICALVasion Print (formerly PrinterLogic) Exposed Internal Docker InstanceEPSS 1.0%CVE-2025-34202HIGHVasion Print (formerly PrinterLogic) Insecure Access to Docker Instances WANEPSS 1.0%CVE-2025-34224CRITICALVasion Print (formerly PrinterLogic) Unauthenticated Device ModificationEPSS 1.0%