Cyber Resilience

CVE-2025-34202

Vasion Virtual Appliance Application ≤ 25.1.1413

Public PoC
Published
19 September 2025
Modified
02 October 2025
Patch / advisory
CVSS Score v4 8.7
Click a component to see what it means
Raw vectorCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0092 57th percentile
Risk Priority 41 floored blend · peak EPSS

Summary

CVE-2025-34202 is a high-severity Reliance on IP Address for Authentication (CWE-291) vulnerability in Vasion Virtual Appliance Application. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Trusted Relationship (T1199); ranked in the top 43% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-8 (Identification and Authentication (Non-organizational Users)) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-34202 is a vulnerability in Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to 25.2.1518, affecting both VA and SaaS deployments. It stems from the exposure of Docker internal networks, enabling direct access to container IPs by attackers on the same external L2 segment or those able to add routes using the appliance as a gateway. This bypasses intended isolation of internal services, including HTTP APIs, Redis, and MySQL, many of which lack authentication or are susceptible to known exploitation chains. The issue is classified under CWE-291 with a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and has been designated by the vendor as V-2025-003 — Insecure Access to Docker Instance from WAN.

Exploitation requires adjacent network access but no privileges or user interaction. An attacker with L2 proximity or routing control through the appliance can reach containerized services directly, leveraging unauthenticated endpoints or chained vulnerabilities to achieve lateral movement, remote code execution, data exfiltration, and full system compromise. Even basic network access to a single reachable endpoint suffices for escalation.

Vendor security bulletins for SaaS and VA deployments detail mitigations, available at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm and https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm. Additional analysis appears in VulnCheck's advisory at https://www.vulncheck.com/advisories/vasion-print-printerlogic-insecure-access-to-docker-instances-wan and researcher Pierre Kim's report at https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-insecure-access-docker-instances-from-wan.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518 (VA and SaaS deployments) expose Docker internal networks in a way that allows an attacker on the same external L2 segment — or an attacker…

more

able to add routes using the appliance as a gateway — to reach container IPs directly. This grants access to internal services (HTTP APIs, Redis, MySQL, etc.) that are intended to be isolated inside the container network. Many of those services are accessible without authentication or are vulnerable to known exploitation chains. As a result, compromise of a single reachable endpoint or basic network access can enable lateral movement, remote code execution, data exfiltration, and full system compromise. This vulnerability has been identified by the vendor as: V-2025-003 — Insecure Access to Docker Instance from WAN.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1199 Trusted Relationship Initial Access
Adversaries may breach or otherwise leverage organizations who have access to intended victims.
T1021 Remote Services Lateral Movement
Adversaries may use [Valid Accounts](https://attack.
T1133 External Remote Services Persistence
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-34218Same product: Vasion Virtual Appliance Application
CVE-2025-34228Same product: Vasion Virtual Appliance Application
CVE-2025-34221Same product: Vasion Virtual Appliance Application
CVE-2025-34225Same product: Vasion Virtual Appliance Application
CVE-2025-34230Same product: Vasion Virtual Appliance Application
CVE-2025-34231Same product: Vasion Virtual Appliance Application
CVE-2025-34224Same product: Vasion Virtual Appliance Application
CVE-2025-34229Same product: Vasion Virtual Appliance Application
CVE-2025-34232Same product: Vasion Virtual Appliance Application
CVE-2025-34215Same product: Vasion Virtual Appliance Application

Affected Assets

vasion
virtual appliance application
≤ 25.1.1413
vasion
virtual appliance host
≤ 25.2.169

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Requires unique identification and authentication of users rather than permitting unauthenticated or spoofable attributes such as source IP.

Requires unique identification and authentication of non-organizational users, precluding reliance on IP address alone.

AC-17 Remote Access partial match

Mandates documented usage restrictions and configuration requirements for remote access that cannot be satisfied by IP-based authentication.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 full match
prevents

Strong authentication mechanisms directly replace reliance on spoofable IP addresses.

PR.AA-01 mostly match
prevents

Managed identities and credentials supplant weak IP-based authentication decisions.

DE.CM-01 partial match
prevents

Network monitoring can detect misuse of IP authentication but does not prevent the weakness.

PR.AA-05 partial match
prevents

Authorization policies and least privilege reduce dependence on network-location assertions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure-authentication control directly addresses the weakness by requiring proper credentials instead of IP address.

prevents

Access-control policy can mandate stronger authentication than IP address alone.

prevents

Identity-management processes should replace IP-based identification with verified identities.

degrades

Authentication-information rules discourage reliance on mutable attributes such as IP addresses.

prevents

Access-rights assignment should be tied to authenticated identities, not network location.

prevents

Privileged-access rules require authenticated users rather than implicit IP trust.

References