Vasion Print CVE-2025-34208

Exploitation is NOT standalone-remote: the attacker must first obtain the stored password database (via another flaw, DB access, or an exposed backup) - this is the precondition encoded as AT:P in the CVSS 4.0 vector. Once the hashes are in hand, cracking is trivial because passwords are stored with unsalted SHA-512 and an unsalted SHA-1 fallback (fast hashes unsuitable for password storage), with no per-user salt, implemented via PHP's hash() in server_write_requests_users.php, update_database.php, and legacy/Login.php. Users whose credentials remain as legacy SHA-1 hashes are at even greater risk, and the login-time SHA-1→SHA-512 migration logic exposes them further. Key limiting factor: the dependency on prior database access caps real-world risk; impact is confidentiality-only (credential disclosure), and the flaw affects VA/SaaS deployments of Vasion Print, with the legacy authentication platform still affected after the partial fix.

Signals conflict and point to a moderate, post-compromise risk rather than an urgent widespread threat. The CVSS 4.0 base score of 8.2 (High) is driven by VC:H and AV:N/PR:N, but the vector also carries AT:P (Attack Requirements: Present), which reflects the true precondition stated in the description - the attacker must FIRST obtain the password database. This is a credential-exposure amplifier, not a directly remotely-triggerable flaw, so the nominal network/unauthenticated metrics overstate standalone exploitability. The weakness-level signals confirm this: EPSS is only 0.08% (24th percentile), indicating very low predicted exploitation probability, and the CVE is NOT in CISA KEV, so there is no confirmed active exploitation. Publicly available exploit code exists (Pierre Kim's disclosure), but POC availability is distinct from active exploitation and does not change the fact that a prior database breach is required. Impact is confidentiality-only (VI/VA = N): no integrity or availability effect. Net assessment: treat as a meaningful hardening priority for defense-in-depth (stolen hashes become cleartext trivially), but not an emergency - the 8.2 is a high-CVSS/low-real-time-risk case gated by the prerequisite of database access. Note also that the description says the issue was only PARTIALLY resolved and persists in the legacy authentication platform, so patched environments may remain exposed.

An attacker who has already gained access to the Vasion Print password store (e.g., via a separate vulnerability, exposed backup, or database compromise) exfiltrates the user hash table. Because passwords are stored as unsalted SHA-512 (with SHA-1 fallback), the attacker runs offline dictionary and precomputed rainbow-table attacks to recover cleartext credentials at high speed. Publicly available exploit/analysis code (Pierre Kim disclosure) documents the weakness and cracking approach.