Vasion Print Virtual Appliance Host versions before 25.1.102 and Application versions before 25.1.1413 contain an SSRF vulnerability in the /var/www/app/console_release/hp/badgeSetup.php script. This script is reachable from the Internet without authentication and uses user-controlled parameters to build URLs that are fetched without any whitelist, scheme restriction, IP range validation, or outbound network filtering. The vulnerability allows unauthenticated attackers to force the server to send arbitrary HTTP requests to internal resources, facilitating internal network reconnaissance and potential data exfiltration. Although the vulnerability is confirmed fixed, the vendor has not specified when the patch was applied.

An unauthenticated attacker can exploit this SSRF vulnerability to make the vulnerable server send arbitrary HTTP requests to internal network resources. This can enable internal network reconnaissance, credential leakage, lateral movement (pivoting), and data exfiltration. The CVSS v4.0 score is 8.8 (high severity), reflecting the network attack vector, no required privileges or user interaction, and high impact on confidentiality. No known exploits in the wild have been reported.

The vulnerability has been confirmed as remediated by the vendor, although the exact patch version or date is not specified. Users should ensure they are running Vasion Print Virtual Appliance Host version 25.1.102 or later and Application version 25.1.1413 or later to be protected. Since no official patch links or advisories are provided, verify with the vendor for the exact remediation status and apply updates accordingly. Until patched, restrict access to the vulnerable script and implement network-level controls to limit outbound HTTP requests from the appliance if possible.