CVE-2025-34223

The `/admin/query/update_database.php` endpoint is accessible without any authentication (CWE-306) and accepts HTTP POST requests with `root_user` and `root_password` parameters. An attacker can submit arbitrary values for these parameters, which causes the default administrator credentials to be overwritten with values controlled by the attacker. The script additionally contains hardcoded SHA-512 and SHA-1 hashes of the default password (CWE-798), which allows bypassing the password policy validation mechanism. The attack is possible during the initial system configuration phase when the installation interface is accessible from the network.

An unauthorized remote attacker gains full administrative control over the Vasion Print Virtual Appliance system, which includes access to all data, configurations, managed printers, and users.

The Virtual Appliance Host should be updated to version 22.0.1049 or newer and the Virtual Appliance Application to version 20.0.2786 or newer as soon as possible. Until the patch is deployed, network access to the installation interface should be restricted exclusively to trusted IP addresses, and the installation endpoint must not be publicly accessible. Detailed information is available in the vendor's security bulletins at help.printerlogic.com.

Vasion Print (PrinterLogic) Virtual Appliance Host in versions earlier than 22.0.1049 and Virtual Appliance Application in versions earlier than 20.0.2786 (VA/SaaS deployments).