This vulnerability (CVE-2025-34230) affects Vasion Print Virtual Appliance Host and Application in versions before 25.1.102 and 25.1.1413 respectively. It arises from missing authentication on a critical function accessed via the /var/www/app/console_release/hp/log_off_single_sign_on.php script. The software constructs a URL using a stored printer host address and performs an HTTP request without validating or restricting the target address, enabling blind SSRF attacks. The attacker can leverage this to interact with internal network services indirectly. The issue is categorized under CWE-306 (Missing Authentication) and CWE-918 (Server-Side Request Forgery). The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity).

An unauthenticated attacker can exploit this vulnerability to send crafted HTTP requests from the vulnerable appliance to internal network services. Although the requests are blind (responses are not visible to the attacker), this can be used to probe internal network resources, trigger internal actions, or gather intelligence about the internal environment. There is no indication of direct data exfiltration or remote code execution from the provided information.

The vulnerability has been confirmed as remediated in Vasion Print Virtual Appliance Host version 25.1.102 and Application version 25.1.1413 or later. Users should upgrade to these or newer versions to address the issue. Since the exact patch introduction date is unclear, verify with the vendor advisory or release notes to ensure the deployment includes the fix. No additional mitigation guidance is provided or required based on the available data.