CVE-2025-34228: Vasion Print (formerly PrinterLogic) SSRF via Lexmark update.php
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a server-side request forgery (SSRF) vulnerability. The /var/www/app/consolerelease/lexmark/update.php script is reachable from the internet without any authentication. The PHP script builds URLs from user‑controlled values and then invokes either 'curlexec() or filegetcontents() without proper validation. Because the endpoint is unauthenticated, any remote attacker can supply a hostname and cause the server to issue requests to internal resources. This enables internal network reconnaissance, potential pivoting, or data exfiltration. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34228?
CVE-2025-34228 is classified as a medium severity vulnerability due to the potential for unauthorized access to sensitive server resources.
How do I fix CVE-2025-34228?
To remediate CVE-2025-34228, upgrade Vasion Print to version 25.1.102 or later for the Virtual Appliance Host and to version 25.1.1413 or later for the Application.
What components are affected by CVE-2025-34228?
CVE-2025-34228 affects the Vasion Print Virtual Appliance Host prior to version 25.1.102 and the Application prior to version 25.1.1413.
What type of vulnerability is CVE-2025-34228?
CVE-2025-34228 is identified as a server-side request forgery (SSRF) vulnerability.
How can CVE-2025-34228 impact my organization?
CVE-2025-34228 can lead to unauthorized access to internal services and potentially sensitive data, posing a risk to organizational security.