CVE-2025-34229
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-29

Last updated on: 2025-10-09

Assigner: VulnCheck

Description
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_release/hp/installApp.php script that can be exploited by an unauthenticated user. When a printer is registered, the software stores the printer’s host name in the variable $printer_vo->str_host_address. The code later builds a URL like 'http://<host‑address>:80/DevMgmt/DiscoveryTree.xml' and sends the request with curl. No validation, whitelist, or private‑network filtering is performed before the request is made. Because the request is blind, an attacker cannot see the data directly, but can still: probe internal services, trigger internal actions, or gather other intelligence. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-29
Last Modified
2025-10-09
Generated
2026-05-07
AI Q&A
2025-09-29
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
vasion virtual_appliance_application to 25.1.1413 (exc)
vasion virtual_appliance_host to 25.1.102 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

CVE-2025-34229 is a blind server-side request forgery (SSRF) vulnerability in Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application prior to certain versions. It occurs because the software does not validate or restrict URLs constructed from printer hostnames before making HTTP requests. An unauthenticated attacker can exploit this by triggering the vulnerable script to make requests to internal services, allowing them to probe or trigger internal actions without directly seeing the response data. [1]


How can this vulnerability impact me? :

This vulnerability can allow an unauthenticated attacker to probe internal network services, trigger internal actions, or gather intelligence about the internal environment. Although the attacker cannot see the response data directly (blind SSRF), they can still use this to map internal services or cause unintended internal requests, potentially leading to further exploitation or information leakage. [1]


How can this vulnerability be detected on my network or system? Can you suggest some commands?

Detection can involve checking for the presence of the vulnerable script /var/www/app/console_release/hp/installApp.php on affected Vasion Print (PrinterLogic) Virtual Appliance Host or Application versions prior to 25.1.102 and 25.1.1413 respectively. Network detection might include monitoring for unusual outbound HTTP requests initiated by the appliance to internal or external hosts on port 80, especially those targeting paths like /DevMgmt/DiscoveryTree.xml. Specific commands are not provided in the resources. [1]


What immediate steps should I take to mitigate this vulnerability?

Immediate mitigation steps include upgrading the Vasion Print Virtual Appliance Host to version 25.1.102 or later, and the Print Application to version 25.1.1413 or later, as these versions contain the confirmed remediation. Until upgrade, restrict network access to the vulnerable appliance to limit exposure and monitor for suspicious activity related to the vulnerable script. [1]


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart