CVE-2025-34208

Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store user passwords using unsalted SHA-512 hashes with a fall-back to unsalted SHA-1. The hashing is performed via PHP's `hash()` function in multiple files (server_write_requests_users.php, update_database.php, legacy/Login.php, tests/Unit/Api/IdpControllerTest.php). No per-user salt is used and the fast hash algorithms are unsuitable for password storage. An attacker who obtains the password database can recover cleartext passwords via offline dictionary or rainbow table attacks. The vulnerable code also contains logic that migrates legacy SHA-1 hashes to SHA-512 on login, further exposing users still on the old hash. This vulnerability was partially resolved, but still present within the legacy authentication platform.

• CWE-327
• CWE-759

• https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htmVendor Advisory
• https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htmVendor Advisory
• https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-incorrect-encryption-algorithms-passwordExploit, Third Party Advisory
• https://www.vulncheck.com/advisories/vasion-print-printerlogic-insecure-password-hashingThird Party Advisory
• https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-incorrect-encryption-algorithms-passwordExploit, Third Party Advisory

Published

Oct 2, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-34202Vasion Print (formerly PrinterLogic) Virtual Appliance Host …8.8
• CVE-2025-34203Vasion Print (formerly PrinterLogic) Virtual Appliance Host …9.8
• CVE-2025-34204Vasion Print (formerly PrinterLogic) Virtual Appliance Host …9.8
• CVE-2025-34205Vasion Print (formerly PrinterLogic) Virtual Appliance Host …9.8
• CVE-2025-34206Vasion Print (formerly PrinterLogic) Virtual Appliance Host …9.8
• CVE-2025-34207Vasion Print (formerly PrinterLogic) Virtual Appliance Host …9.8
• CVE-2025-34209Vasion Print (formerly PrinterLogic) Virtual Appliance Host …7.2
• CVE-2025-3421The Everest Forms – Contact Form, Quiz, Survey, Newsletter &…6.1
• CVE-2025-34210Vasion Print (formerly PrinterLogic) Virtual Appliance Host …5.5
• CVE-2025-34211Vasion Print (formerly PrinterLogic) Virtual Appliance Host …4.9
• CVE-2025-34212Vasion Print (formerly PrinterLogic) Virtual Appliance Host …9.8
• CVE-2025-34213Rejected reason: This CVE ID was rejected because it was res…