← Back to CVE Explorer

CVE-2025-34202

Full vulnerability record from the local CVENow database.

Description

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518 (VA and SaaS deployments) expose Docker internal networks in a way that allows an attacker on the same external L2 segment — or an attacker able to add routes using the appliance as a gateway — to reach container IPs directly. This grants access to internal services (HTTP APIs, Redis, MySQL, etc.) that are intended to be isolated inside the container network. Many of those services are accessible without authentication or are vulnerable to known exploitation chains. As a result, compromise of a single reachable endpoint or basic network access can enable lateral movement, remote code execution, data exfiltration, and full system compromise. This vulnerability has been identified by the vendor as: V-2025-003 — Insecure Access to Docker Instance from WAN.

Severity
HIGH
CVSS score
8.7 (v4.0)
Vulnerability status
Modified
Source identifier
[email protected]
Published
2025-09-19 19:15:41.040000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON 
{
  "id": "CVE-2025-34202",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-19T19:15:41.040",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518 (VA and SaaS deployments) expose Docker internal networks in a way that allows an attacker on the same external L2 segment — or an attacker able to add routes using the appliance as a gateway — to reach container IPs directly. This grants access to internal services (HTTP APIs, Redis, MySQL, etc.) that are intended to be isolated inside the container network. Many of those services are accessible without authentication or are vulnerable to known exploitation chains. As a result, compromise of a single reachable endpoint or basic network access can enable lateral movement, remote code execution, data exfiltration, and full system compromise. This vulnerability has been identified by the vendor as: V-2025-003 — Insecure Access to Docker Instance from WAN."
    },
    {
      "lang": "es",
      "value": "Vasion Print (anteriormente PrinterLogic) Host de Dispositivo Virtual anterior a 25.2.169 y Aplicación anterior a 25.2.1518 (implementaciones VA y SaaS) exponen las redes internas de Docker de una manera que permite a un atacante en el mismo segmento L2 externo - o a un atacante capaz de añadir rutas usando el dispositivo como puerta de enlace - alcanzar las IP de los contenedores directamente. Esto otorga acceso a servicios internos (API HTTP, Redis, MySQL, etc.) que están destinados a ser aislados dentro de la red de contenedores. Muchos de esos servicios son accesibles sin autenticación o son vulnerables a cadenas de explotación conocidas. Como resultado, el compromiso de un único punto final alcanzable o el acceso básico a la red puede permitir el movimiento lateral, la ejecución remota de código, la exfiltración de datos y el compromiso total del sistema. Esta vulnerabilidad ha sido identificada por el proveedor como: V-2025-003 - Acceso Inseguro a Instancia Docker desde WAN."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Vasion",
          "product": "Print Virtual Appliance Host",
          "defaultStatus": "unaffected",
          "modules": [
            "Docker networking (docker_gwbridge) and container network isolation"
          ],
          "versions": [
            {
              "version": "0",
              "lessThan": "25.2.169",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Vasion",
          "product": "Print Application",
          "defaultStatus": "unaffected",
          "modules": [
            "Docker networking (docker_gwbridge) and container network isolation"
          ],
          "versions": [
            {
              "version": "0",
              "lessThan": "25.2.1518",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-20T03:55:47.227085Z",
          "id": "CVE-2025-34202",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-291"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vasion:virtual_appliance_application:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "25.1.1413",
              "matchCriteriaId": "6C86B990-0800-4321-9C0E-666C586C44FB"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vasion:virtual_appliance_host:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "25.2.169",
              "matchCriteriaId": "29D5DC78-608D-4BA5-B4F9-CE7A092F1E2F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-insecure-access-docker-instances-from-wan",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.vulncheck.com/advisories/vasion-print-printerlogic-insecure-access-to-docker-instances-wan",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}