The vulnerability CVE-2025-34224 affects Vasion Print Virtual Appliance Host and Application prior to specified versions, where certain PHP scripts under the console_release directory do not require authentication. This allows unauthenticated remote attackers to invoke these endpoints to reconfigure networked printers, add or delete RFID badge devices, or modify other device settings. The issue is classified as CWE-306, indicating missing authentication for critical functions. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, availability, and security requirements. The vendor has identified this as V-2024-029 but has not published a patch or official remediation guidance yet.

An unauthenticated remote attacker can fully control critical device configuration functions on affected Vasion Print Virtual Appliance Hosts and Applications. This includes reconfiguring printers and managing RFID badge devices, potentially leading to unauthorized device control, disruption of printing services, and compromise of physical access controls. The vulnerability has a maximum CVSS score of 10.0, reflecting its critical impact on confidentiality, integrity, availability, and security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the console_release directory endpoints to trusted administrators only, for example via network segmentation or firewall rules. Monitor for any unusual activity related to device configuration endpoints. Follow vendor communications closely for updates on patches or official mitigations.