Vasion Print Virtual Appliance Host/Print Application prior 22.0.843 resetroot.php dead code

Summaryinfo

A vulnerability was found in Vasion Print Virtual Appliance Host and Print Application. It has been classified as very critical. Affected is an unknown function of the file /var/www/app/resetroot.php. Performing a manipulation results in dead code. This vulnerability is identified as CVE-2025-34205. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as very critical has been found in Vasion Print Virtual Appliance Host and Print Application. This affects an unknown code block of the file /var/www/app/resetroot.php. The manipulation with an unknown input leads to a dead code vulnerability. CWE is classifying the issue as CWE-561. The product contains dead code, which can never be executed. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (VA and SaaS deployments) contains dangerous PHP dead code present in multiple Docker-hosted PHP instances. A script named /var/www/app/resetroot.php (found in several containers) lacks authentication checks and, when executed, performs a SQL update that sets the database administrator username to 'root' and its password hash to the SHA-512 hash of the string 'password'. Separately, commented-out code in /var/www/app/lib/common/oses.php would unserialize session data (unserialize($_SESSION['osdata']))—a pattern that can enable remote code execution if re-enabled or reached with attacker-controlled serialized data. An attacker able to reach the resetroot.php endpoint can trivially reset the MySQL root password and obtain full database control; combined with deserialization issues this can lead to full remote code execution and system compromise.

The weakness was released by Pierre Barre. It is possible to read the advisory at pierrekim.github.io. This vulnerability is uniquely identified as CVE-2025-34205 since 04/15/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/25/2025).

By approaching the search of inurl:var/www/app/resetroot.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 22.0.843 eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2025-30251) and CERT Bund (WID-SEC-2025-2103). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Vasion Print

Productinfo

Vendor

• Vasion

Name

• Print Application
• Print Virtual Appliance Host

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion