CVE-2025-34223: Critical Default Admin and Open Installer in Vasion Print

CVE-2025-34223 is a critical (CVSS 9.8) flaw in Vasion Print, formerly PrinterLogic, affecting virtual appliance and SaaS deployments. The record says host before 22.0.1049 and application before 20.0.2786 are affected, so move to those releases or later. Confirm the exact releases in the vendor bulletin.

What's affected

The record covers Vasion Print (formerly PrinterLogic), virtual appliance and SaaS deployments. The record says host before 22.0.1049 and application before 20.0.2786 are affected, so the fix is in those releases or later.

The record is one of a group published on the same day from an outside research report of 83 issues in the product, and the vendor tracks each under its own bulletin number (V-2024-022, Insecure Installation Credentials). The vendor bulletin page needs a modern browser and could not be read automatically for this post, so check it directly for the exact releases that apply to your deployment.

What the record describes: A default admin account and an installation time endpoint called update_database.php can be reached without authentication, letting someone set new root user and password values, and the script holds hard-coded hashes of the default password.

How to check if you're exposed

Start with the product version. In the Vasion Print administration console, read the version of the Virtual Appliance Host and of the Application, or for client deployments check the installed client version. Compare each against the limits above.

If the deployment is SaaS hosted by the vendor, the vendor is responsible for the server side, so ask the vendor to confirm the fix is applied to your tenant. For the Virtual Appliance, also review which networks can reach the appliance web and SSH ports.

This is a shipped product or appliance, not a package you import, so a manifest scan will not list it. Use your asset inventory, procurement records or network discovery to find every instance, then compare the version you find against the fixed version in the vendor notes. Safeguard's free in-browser dependency scan and the Gold directory are useful for the open source parts of your estate, and you can look up this CVE in Gold to see how it is tracked.

What to do now

1. List every Vasion Print Virtual Appliance and client deployment and record the version.
2. Upgrade to the fixed release in the vendor bulletin. The record says host before 22.0.1049 and application before 20.0.2786 are affected, so move to those releases or later.
3. Read the vendor security bulletins for the whole group of related CVEs and plan one upgrade that covers them.
4. Restrict network access to the appliance to the print servers, admins and clients that need it, and keep it off the public internet.
5. Rotate credentials, keys and certificates that the product holds once you are on a fixed release, where the issue involves secrets.
6. Review appliance and network logs for unexpected admin activity from before the upgrade.

Why it matters

The record ties this to CWE-306 (Missing Authentication for Critical Function), CWE-798 (Use of Hard-coded Credentials). In plain terms, a default admin account and an installation time endpoint called update_database.php can be reached without authentication, letting someone set new root user and password values, and the script holds hard-coded hashes of the default password.

Anyone who can reach the setup interface can take over the system during initial setup. The record gives a score of 9.8, with network access and no privileges needed. It does not flag the CVE as exploited in the wild and it is not on the CISA KEV list. The vendor identifies this item as V-2024-022, Insecure Installation Credentials. Because the same product has many findings of this kind, treat the whole bulletin set as one upgrade project.

Quick check

Sources

• Vasion Print security bulletins (needs a browser, could not be read automatically)
• Appliance bulletins
• Original research report cited in the record

Last reviewed: 18 October 2026.