CVE-2025-34223

🗓️ 29 Sep 2025 20:38:05Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 20 Views🌐 WEB

Unauthenticated attacker can override default admin credentials via installation endpoint, gaining full admin control.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2025-34223	29 Sep 202520:38	–	attackerkb
CNNVD	Vasion Print Virtual Appliance Host 安全漏洞	29 Sep 202500:00	–	cnnvd
Cvelist	CVE-2025-34223 Vasion Print (formerly PrinterLogic) Insecure Installation Credentials	29 Sep 202520:38	–	cvelist
EUVD	EUVD-2025-31638	3 Oct 202520:07	–	euvd
NVD	CVE-2025-34223	29 Sep 202521:15	–	nvd
OSV	CVE-2025-34223	29 Sep 202521:15	–	osv
Positive Technologies	PT-2025-39888	29 Sep 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-34223	30 Sep 202520:56	–	redhatcve
Vulnrichment	CVE-2025-34223 Vasion Print (formerly PrinterLogic) Insecure Installation Credentials	29 Sep 202520:38	–	vulnrichment

NVD

Vulners

CNA

Node

vasion virtual_appliance_applicationRange<20.0.2786

vasion virtual_appliance_hostRange<22.0.1049

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "/admin/query/update_database.php"
    ],
    "product": "Print Virtual Appliance Host",
    "vendor": "Vasion",
    "versions": [
      {
        "lessThan": "22.0.1049",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "modules": [
      "/admin/query/update_database.php"
    ],
    "product": "Print Application",
    "vendor": "Vasion",
    "versions": [
      {
        "lessThan": "20.0.2786",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/vasion-print-printerlogic-insecure-installation-credentials
pierrekim	www.pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html
help	www.help.printerlogic.com/va/Print/Security/Security-Bulletins.htm
help	www.help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm

Parameter	Position	Path	Description	CWE
root_user	request body	/admin/query/update_database.php	Unauthenticated installer can POST credentials to installation endpoint to replace default admin with attacker-controlled ones; hard-coded hashes allow bypass.	CWE-798, CWE-306
root_password	request body	/admin/query/update_database.php	Unauthenticated installer can POST credentials to installation endpoint to replace default admin with attacker-controlled ones; hard-coded hashes allow bypass.	CWE-798, CWE-306

17 Jun 2026 09:13Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.19.8

CVSS 410

EPSS0.01167

SSVC