CVE-2025-34205
Vasion Virtual Appliance Application ≤ 20.0.1923
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-34205 is a critical-severity Dead Code (CWE-561) vulnerability in Vasion Virtual Appliance Application. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 29% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Vasion Print, formerly known as PrinterLogic, is affected by CVE-2025-34205 in Virtual Appliance Host versions prior to 22.0.843 and Application versions prior to 20.0.1923 for both VA and SaaS deployments. The flaw consists of unauthenticated dangerous PHP dead code present across multiple Docker-hosted instances, specifically the script /var/www/app/resetroot.php that performs an unauthenticated SQL update resetting the database administrator account to username root with a SHA-512 hash of the literal string password, plus commented-out session deserialization of attacker-controlled data in /var/www/app/lib/common/oses.php that could enable remote code execution if reached.
An unauthenticated attacker with network access to the resetroot.php endpoint can immediately reset the MySQL root password to obtain full database control; when combined with the deserialization path this grants arbitrary code execution and complete system compromise on the affected containers.
Vendor security bulletins direct customers to upgrade the Virtual Appliance Host to 22.0.843 or newer and the Application to 20.0.1923 or newer; the issue is tracked internally as V-2023-003.
EPSS scores have remained low with a current value of 0.0716 and a peak of only 0.0742, indicating no significant post-disclosure exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-30251
Vulnerability Data
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (VA and SaaS deployments) contains dangerous PHP dead code present in multiple Docker-hosted PHP instances. A script named /var/www/app/resetroot.php (found in several containers) lacks…
more
authentication checks and, when executed, performs a SQL update that sets the database administrator username to 'root' and its password hash to the SHA-512 hash of the string 'password'. Separately, commented-out code in /var/www/app/lib/common/oses.php would unserialize session data (unserialize($_SESSION['osdata']))—a pattern that can enable remote code execution if re-enabled or reached with attacker-controlled serialized data. An attacker able to reach the resetroot.php endpoint can trivially reset the MySQL root password and obtain full database control; combined with deserialization issues this can lead to full remote code execution and system compromise. This vulnerability has been identified by the vendor as: V-2023-003 — Dead / Insecure PHP Code.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation activities can employ static analysis or code-coverage tools that identify unreachable code paths.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can surface dead code but does not directly prevent or eliminate it.
Secure SDLC mandates code reviews and static analysis that detect and remove unreachable code.
Secure coding standards require removal of dead code to improve maintainability and reduce attack surface.
Change-management processes may catch dead code during reviews but are not designed to address it.