CVE-2025-34208: Vasion Print (formerly PrinterLogic) Insecure Password Hashing
Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store user passwords using unsalted SHA-512 hashes with a fall-back to unsalted SHA-1. The hashing is performed via PHP's hash() function in multiple files (serverwriterequestsusers.php, updatedatabase.php, legacy/Login.php, tests/Unit/Api/IdpControllerTest.php). No per-user salt is used and the fast hash algorithms are unsuitable for password storage. An attacker who obtains the password database can recover cleartext passwords via offline dictionary or rainbow table attacks. The vulnerable code also contains logic that migrates legacy SHA-1 hashes to SHA-512 on login, further exposing users still on the old hash. This vulnerability was partially resolved, but still present within the legacy authentication platform.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34208?
CVE-2025-34208 has a high severity due to the use of unsalted SHA-512 and SHA-1 hashes for password storage, making it vulnerable to attacks.
How do I fix CVE-2025-34208?
To fix CVE-2025-34208, immediately update to the latest version of Vasion Print that implements proper salted hashing for password storage.
What versions of Vasion Print are affected by CVE-2025-34208?
All versions of Vasion Print that utilize the vulnerable password hashing methods are affected by CVE-2025-34208.
What are the potential risks of CVE-2025-34208?
The risks of CVE-2025-34208 include unauthorized access to user accounts and potential data breaches due to weak password security.
Is there a way to mitigate CVE-2025-34208 if I cannot update immediately?
If immediate updating is not possible for CVE-2025-34208, it is recommended to implement additional security measures such as multi-factor authentication to enhance protection.