CVE-2025-34230
BaseFortify
Publication date: 2025-09-29
Last updated on: 2025-10-09
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vasion | virtual_appliance_application | to 25.1.1413 (exc) |
| vasion | virtual_appliance_host | to 25.1.102 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-34230 is a blind Server-Side Request Forgery (SSRF) vulnerability in Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application prior to certain versions. It occurs via the /var/www/app/console_release/hp/log_off_single_sign_on.php script, which allows an unauthenticated attacker to make the server send arbitrary HTTP requests to internal or external systems without validation or filtering. The attacker cannot see the response directly (blind SSRF) but can probe internal services, trigger internal actions, or gather intelligence. [1]
How can this vulnerability impact me? :
This vulnerability can allow an unauthenticated attacker to induce the vulnerable server to make arbitrary HTTP requests to internal network services or external systems. Although the attacker cannot see the response directly, they can use this to probe internal services, trigger internal actions, or gather sensitive intelligence. This could lead to further exploitation or information disclosure within the internal network. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve checking for access or attempts to access the vulnerable endpoint /var/www/app/console_release/hp/log_off_single_sign_on.php on affected Vasion Print (PrinterLogic) Virtual Appliance Hosts or Applications. Network monitoring tools or web server logs can be used to identify requests to this script. Specific commands are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Vasion Print Virtual Appliance Host to version 25.1.102 or later and the Application to version 25.1.1413 or later, as these versions contain the confirmed remediation. Additionally, restricting access to the vulnerable endpoint and monitoring for suspicious activity can help reduce risk until patching is complete. [1]