CVE-2025-34216— Vasion Print (formerly PrinterLogic) RCE and Password Leaks via API
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-34216
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vasion Print (formerly PrinterLogic) RCE and Password Leaks via API
Source: NVD (National Vulnerability Database)
Vulnerability Description
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (VA deployments only) expose a set of unauthenticated REST API endpoints that return configuration files and clear‑text passwords. The same endpoints also disclose the Laravel APP_KEY used for cryptographic signing. Because the APP_KEY is required to generate valid signed requests, an attacker who obtains it can craft malicious payloads that are accepted by the application and achieve remote code execution on the appliance. This vulnerability has been identified by the vendor as: V-2024-018 — RCE & Leaks via API.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
关键功能的认证机制缺失
Source: NVD (National Vulnerability Database)
Vulnerability Title
Vasion Print Virtual Appliance Host 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Vasion Print Virtual Appliance Host是美国Vasion公司的一个打印管理软件。 Vasion Print Virtual Appliance Host 22.0.1026之前版本存在安全漏洞，该漏洞源于未经验证的REST API端点暴露配置文件和明文密码，可能导致远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Vasion | Print Virtual Appliance Host | * ~ 22.0.1026 | - | |
| Vasion | Print Application | * ~ 20.0.2702 | - |
II. Public POCs for CVE-2025-34216
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-34216
请登录查看更多情报信息。
Same Patch Batch · Vasion · 2025-09-29 · 22 CVEs total
| CVE-2025-34207 | Vasion Print (formerly PrinterLogic) Insecure SSH Client Configuration | |
| CVE-2025-34229 | Vasion Print (formerly PrinterLogic) Blind SSRF via HP installApp.php | |
| CVE-2025-34212 | Vasion Print (formerly PrinterLogic) Insecure Build Pipeline | |
| CVE-2025-34221 | Vasion Print (formerly PrinterLogic) | |
| CVE-2025-34220 | Vasion Print (formerly PrinterLogic) Unauthenticated API Leaks Group Information | |
| CVE-2025-34215 | Vasion Print (formerly PrinterLogic) Unauthenticated Firmware Update Endpoint RCE | |
| CVE-2025-34222 | Vasion Print (formerly PrinterLogic) Unauthenticated Admin APIs Used to Modify SSL Certifi | |
| CVE-2025-34224 | Vasion Print (formerly PrinterLogic) Unauthenticated Device Modification | |
| CVE-2025-34228 | Vasion Print (formerly PrinterLogic) SSRF via Lexmark update.php | |
| CVE-2025-34225 | Vasion Print (formerly PrinterLogic) SSRF via console_release Directory | |
| CVE-2025-34231 | Vasion Print (formerly PrinterLogic) SSRF via HP badgeSetup.php | |
| CVE-2025-34196 | Vasion Print (formerly PrinterLogic) Hardcoded PrinterLogic CA Private Key and Hardcoded P | |
| CVE-2025-34233 | Vasion Print (formerly PrinterLogic) Insecure Use of file_get_contents() | |
| CVE-2025-34223 | Vasion Print (formerly PrinterLogic) Insecure Installation Credentials | |
| CVE-2025-34230 | Vasion Print (formerly PrinterLogic) Blind SSRF via HP log_off_single_sign_on.php | |
| CVE-2025-34235 | Vasion Print (formerly PrinterLogic) Weak SSL/TLS Certificate Validation RCE | |
| CVE-2025-34209 | Vasion Print (formerly PrinterLogic) Hardcoded GPG Private Key | |
| CVE-2025-34232 | Vasion Print (formerly PrinterLogic) Blind SSRF via Lexmark dellCheck.php | |
| CVE-2025-34234 | Vasion Print (formerly PrinterLogic) Hardcoded Encryption Private Keys | |
| CVE-2025-34218 | Vasion Print (formerly PrinterLogic) Exposed Internal Docker Instance |
Showing top 20 of 22 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Print Virtual Appliance Host
- CVE-2025-34210
Vasion Print (formerly PrinterLogic) Readable Cleartext Pass - CVE-2025-34208
Vasion Print (formerly PrinterLogic) Insecure Password Hashi - CVE-2025-34217
Vasion Print (formerly PrinterLogic) Undocumented Hardcoded - CVE-2025-34235
Vasion Print (formerly PrinterLogic) Weak SSL/TLS Certificat - CVE-2025-34221
Vasion Print (formerly PrinterLogic)
Same vendor: Vasion
- CVE-2025-34210
Vasion Print (formerly PrinterLogic) Readable Cleartext Pass - CVE-2025-34208
Vasion Print (formerly PrinterLogic) Insecure Password Hashi - CVE-2025-34217
Vasion Print (formerly PrinterLogic) Undocumented Hardcoded - CVE-2025-34235
Vasion Print (formerly PrinterLogic) Weak SSL/TLS Certificat - CVE-2025-34221
Vasion Print (formerly PrinterLogic)
Same weakness: CWE-306
- CVE-2021-47940
WordPress Download From Files 1.48 Arbitrary File Upload - CVE-2021-47936
OpenCATS 0.9.4 Remote Code Execution via Resume Upload - CVE-2021-47933
WordPress MStore API 2.0.6 Arbitrary File Upload - CVE-2026-8185
UGREEN CM933 Administrative missing authentication - CVE-2026-42302
FastGPT: Unauthenticated Remote Code Execution (RCE) via cod
V. Comments for CVE-2025-34216
No comments yet