CVE-2025-34215

🗓️ 29 Sep 2025 20:43:12Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 18 Views🌐 WEB

Unauthenticated firmware update in Vasion Print enables remote code execution via private key and token.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2025-34215	29 Sep 202520:43	–	attackerkb
Circl	CVE-2025-34215	30 Sep 202509:03	–	circl
CNNVD	Vasion Print Virtual Appliance Host 安全漏洞	29 Sep 202500:00	–	cnnvd
Cvelist	CVE-2025-34215 Vasion Print (formerly PrinterLogic) Unauthenticated Firmware Update Endpoint RCE	29 Sep 202520:43	–	cvelist
EUVD	EUVD-2025-31625	3 Oct 202520:07	–	euvd
NVD	CVE-2025-34215	29 Sep 202521:15	–	nvd
OSV	CVE-2025-34215	29 Sep 202521:15	–	osv
Positive Technologies	PT-2025-39882	29 Sep 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-34215	30 Sep 202520:56	–	redhatcve
Vulnrichment	CVE-2025-34215 Vasion Print (formerly PrinterLogic) Unauthenticated Firmware Update Endpoint RCE	29 Sep 202520:43	–	vulnrichment

NVD

Vulners

CNA

Node

vasion virtual_appliance_applicationRange<20.0.2702

vasion virtual_appliance_hostRange<22.0.1026

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "/admin/design/management_accountts_pcabout.php",
      "/va‑api/v1/update",
      "private key embedded in the appliance"
    ],
    "product": "Print Virtual Appliance Host",
    "vendor": "Vasion",
    "versions": [
      {
        "lessThan": "22.0.1026",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "modules": [
      "/admin/design/management_accountts_pcabout.php",
      "/va‑api/v1/update",
      "private key embedded in the appliance"
    ],
    "product": "Print Application",
    "vendor": "Vasion",
    "versions": [
      {
        "lessThan": "20.0.2702",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
pierrekim	www.pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html
vulncheck	www.vulncheck.com/advisories/vasion-print-printerlogic-unauth-firmware-update-endpoint-rce
help	www.help.printerlogic.com/va/Print/Security/Security-Bulletins.htm
help	www.help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm

Parameter	Position	Path	Description	CWE
firmware	request body	va-api/v1/update	Unauthenticated firmware upload endpoint enabling remote code execution via a signed token.	CWE-321, CWE-306
token	request body	va-api/v1/update	Unauthenticated firmware upload endpoint enabling remote code execution via a signed token.	CWE-321, CWE-306

17 Jun 2026 09:13Current

7.6High risk

Vulners AI Score7.6

CVSS 3.19.8

CVSS 49.4

EPSS0.01036

SSVC