CVE-2025-34231

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind and non-blind server-side request forgery (SSRF) vulnerability. The '/var/www/app/console_release/hp/badgeSetup.php' script is reachable from the Internet without any authentication and builds URLs from user‑controlled parameters before invoking either the custom processCurl() function or PHP’s file_get_contents(); in both cases the hostname/URL is taken directly from the request with no whitelist, scheme restriction, IP‑range validation, or outbound‑network filtering. Consequently, any unauthenticated attacker can force the server to issue arbitrary HTTP requests to internal resources. This enables internal network reconnaissance, credential leakage, pivoting, and data exfiltration. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.

• CWE-306
• CWE-918
• CWE-918

• https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htmVendor Advisory
• https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htmVendor Advisory
• https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-ssrf-07Exploit, Third Party Advisory
• https://www.vulncheck.com/advisories/vasion-print-printerlogic-ssrf-via-hp-badgesetup-php-scriptThird Party Advisory
• https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-ssrf-07Exploit, Third Party Advisory

Published

Sep 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-34226OpenPLC Runtime v3 contains an input validation flaw in the …7.1
• CVE-2025-34227Nagios XI < 2026R1 is vulnerable to an authenticated command…8.8
• CVE-2025-34228Vasion Print (formerly PrinterLogic) Virtual Appliance Host …8.6
• CVE-2025-34229Vasion Print (formerly PrinterLogic) Virtual Appliance Host …5.8
• CVE-2025-3423IBM Aspera Faspex 5.0.0 through 5.0.11 is vulnerable to cros…5.4
• CVE-2025-34230Vasion Print (formerly PrinterLogic) Virtual Appliance Host …5.8
• CVE-2025-34232Vasion Print (formerly PrinterLogic) Virtual Appliance Host …5.3
• CVE-2025-34233Vasion Print (formerly PrinterLogic) Virtual Appliance Host …6.8
• CVE-2025-34234Vasion Print (formerly PrinterLogic) Virtual Appliance Host …7.5
• CVE-2025-34235Vasion Print (formerly PrinterLogic) Virtual Appliance Host …7.8
• CVE-2025-34236Advantech WebAccess/VPN versions prior to 1.1.5 contain a st…5.4
• CVE-2025-34237Advantech WebAccess/VPN versions prior to 1.1.5 contain a st…5.4