CVE-2025-34208

🗓️ 02 Oct 2025 16:13:06Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 20 Views🌐 WEB

Passwords use unsalted fast hashes with no per user salt; legacy hashes migrate on login, enabling offline attacks.

Reporter	Title	Published	Views	Family All 7
CNNVD	Vasion Print 安全漏洞	2 Oct 202500:00	–	cnnvd
Cvelist	CVE-2025-34208 Vasion Print (formerly PrinterLogic) Insecure Password Hashing	2 Oct 202516:13	–	cvelist
EUVD	EUVD-2025-32184	3 Oct 202520:07	–	euvd
NVD	CVE-2025-34208	2 Oct 202517:16	–	nvd
Positive Technologies	PT-2025-40401	2 Oct 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-34208	3 Oct 202516:58	–	redhatcve
Vulnrichment	CVE-2025-34208 Vasion Print (formerly PrinterLogic) Insecure Password Hashing	2 Oct 202516:13	–	vulnrichment

NVD

CNA

Node

vasion virtual_appliance_applicationMatch-

vasion virtual_appliance_hostMatch-

[
  {
    "defaultStatus": "unknown",
    "modules": [
      "/var/www/app/admin/query/server_write_requests_users.php",
      "/var/www/app/admin/query/update_database.php",
      "/var/www/app/legacy/Login.php",
      "/var/www/app/tests/Unit/Api/IdP/IdpControllerTest.php"
    ],
    "product": "Print Virtual Appliance Host",
    "vendor": "Vasion",
    "versions": [
      {
        "status": "affected",
        "version": "*"
      }
    ]
  },
  {
    "defaultStatus": "unknown",
    "modules": [
      "/var/www/app/admin/query/server_write_requests_users.php",
      "/var/www/app/admin/query/update_database.php",
      "/var/www/app/legacy/Login.php",
      "/var/www/app/tests/Unit/Api/IdP/IdpControllerTest.php"
    ],
    "product": "Print Application",
    "vendor": "Vasion",
    "versions": [
      {
        "status": "affected",
        "version": "*"
      }
    ]
  }
]

Source	Link
help	www.help.printerlogic.com/va/Print/Security/Security-Bulletins.htm
help	www.help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
pierrekim	www.pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html
vulncheck	www.vulncheck.com/advisories/vasion-print-printerlogic-insecure-password-hashing

Parameter	Position	Path	Description	CWE
password	path	server_write_requests_users.php	Passwords are stored using unsalted SHA-512/H1 with a fall-back to SHA-1, exposed during login and user management flows; no per-user salt and legacy hashing migrates on login, enabling offline attacks.	CWE-759, CWE-327
password	path	update_database.php	Password storage uses weak hashing (unsalted hashes) and legacy migration on login; lacks per-user salt, enabling offline attacks on the password database.	CWE-759, CWE-327
hash	path	update_database.php	Password storage uses weak hashing (unsalted hashes) and legacy migration on login; lacks per-user salt, enabling offline attacks on the password database.	CWE-759, CWE-327
salt	path	update_database.php	Password storage uses weak hashing (unsalted hashes) and legacy migration on login; lacks per-user salt, enabling offline attacks on the password database.	CWE-759, CWE-327
password	path	legacy/Login.php	Legacy authentication logic uses weak unsalted hashes and migrates legacy SHA-1 to SHA-512 on login, exposing users still on old hashes to offline attacks.	CWE-759, CWE-327

17 Jun 2026 09:13Current

7High risk

Vulners AI Score7

CVSS 3.17.5

CVSS 48.2

EPSS0.00411

SSVC