This vulnerability (CVE-2025-34223) affects Vasion Print Virtual Appliance Host and Application in VA/SaaS deployments before specified versions. The issue is due to a default admin account and an installation endpoint (/admin/query/update_database.php) accessible without authentication. Attackers can POST arbitrary root_user and root_password values to this endpoint, replacing default admin credentials. Hard-coded SHA-512 and SHA-1 password hashes in the script allow bypassing password policy validation. Consequently, an unauthenticated remote attacker can gain full administrative privileges during initial setup. The vendor has identified this as V-2024-022 — Insecure Installation Credentials.

An unauthenticated remote attacker who can access the installation web interface can fully compromise the system by replacing default admin credentials with attacker-controlled ones. This leads to complete administrative control over the affected Vasion Print Virtual Appliance Host or Application during initial setup. The CVSS 4.0 base score is 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the installation interface to trusted administrators only to prevent unauthorized access. Monitor vendor communications for updates on patches or official mitigations addressing this vulnerability.