Vasion Print CVE-2025-34210

Requires local presence on the Vasion Print VA/SaaS appliance: the attacker must be any local user on the host, or any process/account able to read the host filesystem. The specific prerequisite is that the sensitive files (database passwords, MySQL root password, SaaS keys, Portainer admin password) are stored in cleartext with world-readable permissions - which is the default per the disclosure. The primary LIMITING factor is that exploitation is local-only (no network vector) and the vendor states the risk is mitigated when administrators enable persistent-storage encryption, so deployments that have configured storage encryption per the vendor's shared-responsibility guidance materially reduce exposure. No user interaction and no elevated privileges beyond local filesystem read are needed.

Signals here point strongly toward low real-world urgency despite the headline CVSS 4.0 base score of 9.4. The CVSS vector is explicitly local (AV:L), not network, so this cannot be exploited remotely - the high score is driven by the HIGH vulnerable- and subsequent-system impact metrics (VC/VI/VA and SC/SI/SA all H), reflecting that harvested database, MySQL root, SaaS, and Portainer credentials enable full appliance and downstream compromise once an attacker is already on the host. EPSS is 0.01% (1st percentile), among the lowest possible, which is consistent with a local-only information-disclosure bug that offers no mass-scannable, remotely automatable surface. This CVE is NOT in CISA KEV, so there is no confirmed active exploitation; POC exploit code is publicly available (Pierre Kim's detailed disclosure), but POC availability is a distinct signal from in-the-wild use and should not be conflated with it. A notable conflict to flag: the vendor formally DISPUTES this as a vulnerability, arguing a shared-responsibility model where administrators are expected to enable persistent-storage encryption - so defenders must independently decide whether their deployment matches the vendor's assumed configuration. Net assessment: real but conditional risk - meaningful as a privilege-escalation/post-compromise amplifier (any local foothold becomes full appliance and credential-chain compromise), not a remote entry point or patch-now emergency.

An attacker who already has any local account on the Vasion Print virtual appliance - or any process able to read the host filesystem (e.g., a low-privilege service, a chained prior bug, or a malicious insider) - reads the world-readable cleartext files and harvests database passwords, the MySQL root password, SaaS keys, and the Portainer admin password. Using those recovered secrets, they pivot to full control of the appliance and connected backend/SaaS services. Publicly available POC/disclosure details the exact readable file locations, lowering the effort required.