CVE-2025-34200 json
Vasion Print (formerly PrinterLogic) Network Account Password Stored in Cleartext
published 2025-09-19 13 mo ago modified 2026-11-08 38 h ago also EUVD-2025-30260
- cvss
- 7.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) provision the appliance with the network account credentials in clear-text inside /etc/issue, and the file is world-readable by default. An attacker with local shell access can read /etc/issue to obtain the network account username and password. Using the network account an attacker can change network parameters via the appliance interface, enabling local misconfiguration, network disruption or further escalation depending on deployment.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 13 mo ago
Exploit prediction
0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- pierrekim.github.io https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-clear-text-password referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Vasion Print Virtual Appliance Host
- Vasion Print Application
Classification
- Weakness
-
- CWE-312 Cleartext Storage of Sensitive Information
References
-
pierrekim.github.io
/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-clear-text-password
technical-description, exploit, third-party-advisory
-
help.printerlogic.com
/saas/Print/Security/Security-Bulletins.htm
product, vendor-advisory
-
help.printerlogic.com
/va/Print/Security/Security-Bulletins.htm
product, vendor-advisory
-
vulncheck.com
/advisories/vasion-print-printerlogic-network-account-password-stored-in-cleartext
third-party-advisory
Sources
- CVE List CVE-2025-34200
- NVD CVE-2025-34200
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.