CVE-2025-34203
Vasion Virtual Appliance Application ≤ 20.0.2614
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-34203 is a critical-severity an unspecified weakness vulnerability in Vasion Virtual Appliance Application. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 44% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-34203 affects Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.1002 and Application versions prior to 20.0.2614 across VA and SaaS deployments. The vulnerability stems from multiple Docker containers that incorporate outdated, end-of-life, unsupported, or otherwise vulnerable third-party components, including Nginx 1.17.x, OpenSSL 1.1.1d, various EOL Alpine/Debian/Ubuntu base images, and EOL Laravel/PHP libraries such as Laravel 5.5.x, 5.7.x, and 5.8.x. Nginx binaries in several images date back to 2019, with multiple distinct EOL versions and unpatched libraries present across many container images. The vendor designates this as V-2024-014 – Outdated Dependencies, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction. The presence of these vulnerable components across containers increases the attack surface, enabling attackers to chain exploits targeting the outdated dependencies for high impacts on confidentiality, integrity, and availability.
Vendor security bulletins for SaaS and VA deployments detail mitigation steps, recommending upgrades to Virtual Appliance Host version 22.0.1002 or later and Application version 20.0.2614 or later to remediate the outdated components. Further analysis appears in advisories from VulnCheck and researcher Pierre Kim's report on 83 vulnerabilities in Vasion/PrinterLogic products.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-30257
Vulnerability Data
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.1002 and Application versions prior to 20.0.2614 (VA and SaaS deployments) contain multiple Docker containers that include outdated, end-of-life, unsupported, or otherwise vulnerable third-party components (examples: Nginx 1.17.x, OpenSSL 1.1.1d,…
more
various EOL Alpine/Debian/Ubuntu base images, and EOL Laravel/PHP libraries). These components are present across many container images and increase the product's attack surface, enabling exploitation chains when leveraged by an attacker. Multiple distinct EOL versions and unpatched libraries across containers; Nginx binaries date from 2019 in several images and Laravel versions observed include EOL releases (for example Laravel 5.5.x, 5.7.x, 5.8.x). This vulnerability has been identified by the vendor as: V-2024-014 — Outdated Dependencies.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.