CVE-2025-34202
Vasion Virtual Appliance Application ≤ 25.1.1413
Raw vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-34202 is a high-severity Reliance on IP Address for Authentication (CWE-291) vulnerability in Vasion Virtual Appliance Application. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Trusted Relationship (T1199); ranked in the top 43% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-8 (Identification and Authentication (Non-organizational Users)) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-34202 is a vulnerability in Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to 25.2.1518, affecting both VA and SaaS deployments. It stems from the exposure of Docker internal networks, enabling direct access to container IPs by attackers on the same external L2 segment or those able to add routes using the appliance as a gateway. This bypasses intended isolation of internal services, including HTTP APIs, Redis, and MySQL, many of which lack authentication or are susceptible to known exploitation chains. The issue is classified under CWE-291 with a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and has been designated by the vendor as V-2025-003 — Insecure Access to Docker Instance from WAN.
Exploitation requires adjacent network access but no privileges or user interaction. An attacker with L2 proximity or routing control through the appliance can reach containerized services directly, leveraging unauthenticated endpoints or chained vulnerabilities to achieve lateral movement, remote code execution, data exfiltration, and full system compromise. Even basic network access to a single reachable endpoint suffices for escalation.
Vendor security bulletins for SaaS and VA deployments detail mitigations, available at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm and https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm. Additional analysis appears in VulnCheck's advisory at https://www.vulncheck.com/advisories/vasion-print-printerlogic-insecure-access-to-docker-instances-wan and researcher Pierre Kim's report at https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-insecure-access-docker-instances-from-wan.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-30258
Vulnerability Data
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518 (VA and SaaS deployments) expose Docker internal networks in a way that allows an attacker on the same external L2 segment — or an attacker…
more
able to add routes using the appliance as a gateway — to reach container IPs directly. This grants access to internal services (HTTP APIs, Redis, MySQL, etc.) that are intended to be isolated inside the container network. Many of those services are accessible without authentication or are vulnerable to known exploitation chains. As a result, compromise of a single reachable endpoint or basic network access can enable lateral movement, remote code execution, data exfiltration, and full system compromise. This vulnerability has been identified by the vendor as: V-2025-003 — Insecure Access to Docker Instance from WAN.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires unique identification and authentication of users rather than permitting unauthenticated or spoofable attributes such as source IP.
Requires unique identification and authentication of non-organizational users, precluding reliance on IP address alone.
Mandates documented usage restrictions and configuration requirements for remote access that cannot be satisfied by IP-based authentication.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Strong authentication mechanisms directly replace reliance on spoofable IP addresses.
Managed identities and credentials supplant weak IP-based authentication decisions.
Network monitoring can detect misuse of IP authentication but does not prevent the weakness.
Authorization policies and least privilege reduce dependence on network-location assertions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure-authentication control directly addresses the weakness by requiring proper credentials instead of IP address.
Access-control policy can mandate stronger authentication than IP address alone.
Identity-management processes should replace IP-based identification with verified identities.
Authentication-information rules discourage reliance on mutable attributes such as IP addresses.
Access-rights assignment should be tied to authenticated identities, not network location.
Privileged-access rules require authenticated users rather than implicit IP trust.