CVE-2025-34205 Vasion Print (formerly PrinterLogic) Dangerous PHP Dead Code Enables RCE
Unauthenticated access to a dead PHP script allows resetting the database root password, leading to full system compromise and remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34205?
CVE-2025-34205 is a critical authentication bypass vulnerability in Vasion Print Application, published on 19 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (VA and SaaS deployments) contains dangerous PHP dead code present in multiple Docker-hosted PHP instances. A script named /var/www/app/resetroot.php (found in several containers) lacks authentication checks and, when executed, performs a SQL update that sets the database administrator username to 'root' and its password hash to the SHA-512 hash of the string 'password'. Separately, commented-out code in /var/www/app/lib/common/oses.php would unserialize session data (unserialize($_SESSION['osdata']))—a pattern that can enable remote code execution if re-enabled or reached with attacker-controlled serialized data. An attacker able to reach the resetroot.php endpoint can trivially reset the MySQL root password and obtain full database control; combined with deserialization issues this can lead to full remote code execution and system compromise. This vulnerability has been identified by the vendor as: V-2023-003 — Dead / Insecure PHP Code.
Weakness: CWE-561
Which versions are affected by CVE-2025-34205?
It affects 2 products.
Products include Vasion Virtual Appliance Application, Vasion Virtual Appliance Host.
How do I fix CVE-2025-34205?
No fix has been published for CVE-2025-34205 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-34205 being exploited?
There is no known exploitation of CVE-2025-34205 in the wild and no public exploit code.
Other vulnerabilities in Vasion Print Application
- CVE-2025-34217 Vasion Print (formerly PrinterLogic) Undocumented Hardcoded SSH Key
- CVE-2025-34216 Vasion Print (formerly PrinterLogic) RCE and Password Leaks via API
- CVE-2025-34218 Vasion Print (formerly PrinterLogic) Exposed Internal Docker Instance
- CVE-2025-34221 Vasion Print (formerly PrinterLogic)
- CVE-2025-34222 Vasion Print (formerly PrinterLogic) Unauthenticated Admin APIs Used to Modify SSL Certificates
Sources
Also known as GHSA-qh57-ggq7-34mf.