CVE-2025-34222: virtual appliance application before 20.0.2786 (exclusive); +3 more affected products

Affected technology

virtual appliance application · before 20.0.2786 (exclusive)
vasion

virtual appliance host · before 22.0.1049 (exclusive)
vasion

Print Virtual Appliance Host · 0 to before 22.0.1049
Vasion

Print Application · 0 to before 20.0.2786
Vasion

Description’s affected range: prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose four admin routes – /admin/hp/cert_upload

Component: /admin/hp/cert_upload, /admin/hp/cert_delete, /admin/certs/ca, /admin/certs/serviceclients/{scid}

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can therefore upload a new TLS/SSL certificate replacing the trusted root used by the appliance, delete an existing certificate causing immediate loss of trust for services that rely on it, or download any stored CA or client certificate via the service‑clients endpoint which also suffers an IDOR that allows enumeration of all client IDs. Vendor/CNA’s CVSS 4.0 assessment (base score 10.0/10) rates confidentiality, integrity and availability impact as high.