CVE-2025-34208

🗓️ 02 Oct 2025 16:13:06Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 40 Views🌐 WEB

Passwords use unsalted fast hashes with no per user salt; legacy hashes migrate on login, enabling offline attacks.

Reporter	Title	Published	Views	Family All 8
CNNVD	Vasion Print 安全漏洞	2 Oct 202500:00	–	cnnvd
Cvelist	CVE-2025-34208 Vasion Print (formerly PrinterLogic) Insecure Password Hashing	2 Oct 202516:13	–	cvelist
EUVD	EUVD-2025-32184	3 Oct 202520:07	–	euvd
NVD	CVE-2025-34208	2 Oct 202517:16	–	nvd
Positive Technologies	PT-2025-40401	2 Oct 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2025-34208: Use of a Broken or Risky Cryptographic Algorithm	2 Oct 202500:00	–	rapid7
RedhatCVE	CVE-2025-34208	3 Oct 202516:58	–	redhatcve
Vulnrichment	CVE-2025-34208 Vasion Print (formerly PrinterLogic) Insecure Password Hashing	2 Oct 202516:13	–	vulnrichment

NVD

CNA

Node

vasion virtual_appliance_applicationMatch-

vasion virtual_appliance_hostMatch-

[
  {
    "defaultStatus": "unknown",
    "modules": [
      "/var/www/app/admin/query/server_write_requests_users.php",
      "/var/www/app/admin/query/update_database.php",
      "/var/www/app/legacy/Login.php",
      "/var/www/app/tests/Unit/Api/IdP/IdpControllerTest.php"
    ],
    "product": "Print Virtual Appliance Host",
    "vendor": "Vasion",
    "versions": [
      {
        "status": "affected",
        "version": "*"
      }
    ]
  },
  {
    "defaultStatus": "unknown",
    "modules": [
      "/var/www/app/admin/query/server_write_requests_users.php",
      "/var/www/app/admin/query/update_database.php",
      "/var/www/app/legacy/Login.php",
      "/var/www/app/tests/Unit/Api/IdP/IdpControllerTest.php"
    ],
    "product": "Print Application",
    "vendor": "Vasion",
    "versions": [
      {
        "status": "affected",
        "version": "*"
      }
    ]
  }
]

Source	Link
help	www.help.printerlogic.com/va/Print/Security/Security-Bulletins.htm
pierrekim	www.pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html
vulncheck	www.vulncheck.com/advisories/vasion-print-printerlogic-insecure-password-hashing
help	www.help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm

Parameter	Position	Path	Description	CWE
password	request body	/legacy/Login.php	Login authentication uses insecure, unsalted hashes stored via PHP hash() (SHA-512/SHA-1); migrates legacy SHA-1 on login, enabling offline cracking if the password database is exposed.	CWE-327, CWE-759
password	request body	/server_write_requests_users.php	User/password handling writes passwords using unsalted hashes via PHP hash(); no per-user salt.	CWE-327, CWE-759
password	request body	/update_database.php	Database update path performs legacy hash migration on login, but continues using unsalted hashes.	CWE-327, CWE-759

17 Jun 2026 09:13Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

CVSS 48.2

EPSS0.00437

SSVC