CVE-2025-34202: virtual appliance application before 25.1.1413 (exclusive); +3 more affected products

Affected technology

virtual appliance application · before 25.1.1413 (exclusive)
vasion

virtual appliance host · before 25.2.169 (exclusive)
vasion

Print Virtual Appliance Host · 0 to before 25.2.169
Vasion

Print Application · 0 to before 25.2.1518
Vasion

Description’s affected range: prior to 25.2.169 and Application prior to 25.2.1518 (VA and SaaS deployments) expose Docker internal networks in a way that allows an attacker on the same external L2 segment — or an attacker able to add routes using the appliance as a gateway — to reach container IPs directly

Component: Docker networking (docker_gwbridge) and container network isolation

Attack conditions (Vendor/CNA, CVSS 4.0): Adjacent network · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could run code remotely. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.