Auth bypass in Vasion Print Application
CVE-2025-34221
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 25.2.1518 (VA/SaaS deployments) expose every internal Docker container to the network because firewall rules allow unrestricted traffic to the Docker bridge network. Because no authentication, ACL or client‑side identifier is required, the attacker can interact with any internal API, bypassing the product’s authentication mechanisms entirely. The result is unauthenticated remote access to internal services, allowing credential theft, configuration manipulation and potential remote code execution. This vulnerability has been identified by the vendor as: V-2025-002 — Authentication Bypass - Docker Instances.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.015 (73.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 73rd percentile — 73.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html (Exploit, technical-description, Third Party Advisory)
- help.printerlogic.com/va/Print/Security/Security-Bulletins.htm (vendor-advisory, patch, Vendor Advisory)
- help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm (vendor-advisory, patch, Vendor Advisory)
- www.vulncheck.com/advisories/vasion-print-printerlogic-unrestriced-access-to-do… (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2025-34221?
- CVE-2025-34221 is a critical-severity vulnerability in Vasion Print Application, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2025-09-29.
- How severe is CVE-2025-34221?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2025-34221 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.