CVE-2025-34215: CWE-306 Missing Authentication for Critical Function in Vasion Print Virtual Appliance Host
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (only VA deployments) expose an unauthenticated firmware-upload flow: a public page returns a signed token usable at va-api/v1/update, and every Docker image contains the appliance’s private GPG key and hard-coded passphrase. An attacker who extracts the key and obtains a token can decrypt, modify, re-sign, upload, and trigger malicious firmware, gaining remote code execution. This vulnerability has been identified by the vendor as: V-2024-020 — Remote Code Execution.
AI Analysis
Technical Summary
The vulnerability CVE-2025-34215 in Vasion Print Virtual Appliance Host is caused by missing authentication controls on a critical firmware-upload function. A public endpoint issues a signed token that can be used at the va-api/v1/update endpoint. Compounding the issue, the private GPG key and its passphrase are embedded in every Docker image, enabling an attacker who obtains these credentials and a token to decrypt, alter, re-sign, and upload malicious firmware. Successful exploitation results in remote code execution on the appliance. The vendor has identified this as V-2024-020 with a CVSS 4.0 score of 9.4, indicating critical severity.
Potential Impact
An attacker who can extract the private GPG key and obtain a signed token can upload malicious firmware to the appliance, resulting in remote code execution. This compromises the integrity and security of the appliance, potentially allowing full control over the affected system. The vulnerability affects all versions prior to 22.0.1026 for the Virtual Appliance Host and prior to 20.0.2702 for the Application in VA deployments.
Mitigation Recommendations
Patch status is not yet confirmed — no official patch or remediation guidance is provided in the available data. Users should monitor the vendor advisory for updates and apply any official fixes once released. Until then, restrict access to the appliance and its Docker images to trusted personnel only to reduce the risk of key extraction and token misuse.
CVE-2025-34215: CWE-306 Missing Authentication for Critical Function in Vasion Print Virtual Appliance Host
Description
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (only VA deployments) expose an unauthenticated firmware-upload flow: a public page returns a signed token usable at va-api/v1/update, and every Docker image contains the appliance’s private GPG key and hard-coded passphrase. An attacker who extracts the key and obtains a token can decrypt, modify, re-sign, upload, and trigger malicious firmware, gaining remote code execution. This vulnerability has been identified by the vendor as: V-2024-020 — Remote Code Execution.
CVSS v4.0
Score 9.4critical
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2025-34215 in Vasion Print Virtual Appliance Host is caused by missing authentication controls on a critical firmware-upload function. A public endpoint issues a signed token that can be used at the va-api/v1/update endpoint. Compounding the issue, the private GPG key and its passphrase are embedded in every Docker image, enabling an attacker who obtains these credentials and a token to decrypt, alter, re-sign, and upload malicious firmware. Successful exploitation results in remote code execution on the appliance. The vendor has identified this as V-2024-020 with a CVSS 4.0 score of 9.4, indicating critical severity.
Potential Impact
An attacker who can extract the private GPG key and obtain a signed token can upload malicious firmware to the appliance, resulting in remote code execution. This compromises the integrity and security of the appliance, potentially allowing full control over the affected system. The vulnerability affects all versions prior to 22.0.1026 for the Virtual Appliance Host and prior to 20.0.2702 for the Application in VA deployments.
Mitigation Recommendations
Patch status is not yet confirmed — no official patch or remediation guidance is provided in the available data. Users should monitor the vendor advisory for updates and apply any official fixes once released. Until then, restrict access to the appliance and its Docker images to trusted personnel only to reduce the risk of key extraction and token misuse.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2025-04-15T19:15:22.572Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 68daefb54b0d68cddf56c5d2
Added to database: 09/29/2025, 20:44:37 UTC
Last enriched: 05/16/2026, 09:20:42 UTC
Last updated: 09/10/2026, 19:24:56 UTC
Views: 212
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.