This vulnerability arises from dead/insecure PHP code present in Vasion Print Virtual Appliance Host and Application versions before specified releases. The resetroot.php script lacks authentication and allows resetting the MySQL root password to a fixed weak value, enabling trivial database takeover. Furthermore, commented-out unserialize calls in session handling code represent a latent risk for remote code execution if activated. The CVSS 4.0 score is 9.3 (critical), reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. The vendor has identified this as V-2023-003 — Dead / Insecure PHP Code. No patch or remediation link is provided in the data, and this is not a cloud service.

An attacker with network access to the resetroot.php endpoint can reset the MySQL root password to a known weak hash, gaining full database control without authentication. This compromises confidentiality, integrity, and availability of the database. The presence of insecure unserialize code, if re-enabled or exploited, could lead to remote code execution and full system compromise. The vulnerability is rated critical with a CVSS 4.0 score of 9.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the resetroot.php endpoint and audit Docker containers for the presence of this script. Remove or secure any dead or commented-out PHP code that could be re-enabled to prevent deserialization attacks. Monitor vendor communications for an official patch or update addressing V-2023-003.