Skip to content
OpenAdvisories
High WID-SEC-2025-2103 18 CVEs

Vasion Print: Mehrere Schwachstellen

Published Sep 21, 2025 · Updated Sep 21, 2025 · de-DE

Vendor: Vasion Product: Print Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Vasion Print ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Informationen offenzulegen, einen Denial of Service zu verursachen oder seine Rechte zu erweitern.

Product

Vasion Print (ehemals PrintLogic) ist eine Softwarelösung, die das Druckmanagement und die Dokumentenautomatisierung in Unternehmen ermöglicht.

Vulnerabilities 18

  • Critical 9.3
    CVE-2025-34192

    Vasion Print (formerly PrinterLogic) Usage of Outdated and Unsupported OpenSSL Version

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.893 and Application versions prior to 20.0.2140 (macOS/Linux client deployments) are built against OpenSSL 1.0.2h-fips (released May 2016), which has been end-of-life since 201…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 9.3
    CVE-2025-34198

    Vasion Print (formerly PrinterLogic) Shared / Hardcoded SSH Host Private Keys in Appliance Image

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.951 and Application prior to 20.0.2368 (VA and SaaS deployments) contain shared, hardcoded SSH host private keys in the appliance image. The same private host keys (RSA, ECDSA,…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 9.3
    CVE-2025-34199

    Vasion Print (formerly PrinterLogic) Insecure SSL Verification Allows Man-in-the-Middle Attacks

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.1049 and Application versions prior to 20.0.2786 (VA and SaaS deployments) contain insecure defaults and code patterns that disable TLS/SSL certificate verification for communi…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 9.3
    CVE-2025-34203

    Vasion Print (formerly PrinterLogic) Use of Outdated, End-Of-Life, and Vulnerable Third-Party Components

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.1002 and Application versions prior to 20.0.2614 (VA and SaaS deployments) contain multiple Docker containers that include outdated, end-of-life, unsupported, or otherwise vuln…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 9.3
    CVE-2025-34205

    Vasion Print (formerly PrinterLogic) Dangerous PHP Dead Code Enables RCE

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (VA and SaaS deployments) contains dangerous PHP dead code present in multiple Docker-hosted PHP instances. A script named /var/www/app/r…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 9.3
    CVE-2025-34206

    Vasion Print (formerly PrinterLogic) Insecure Shared Storage Permissions

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host configuration and secret material under /var/www/efs_storage into many Docker containers with overly-permissive filesystem permissions. Files such…

    Vasion Print Virtual Appliance Host Print Application (SaaS/VA)
  • High 8.7
    CVE-2025-34202

    Vasion Print (formerly PrinterLogic) Insecure Access to Docker Instances WAN

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518 (VA and SaaS deployments) expose Docker internal networks in a way that allows an attacker on the same external L2 segment — or an attacker able t…

    Vasion Print Virtual Appliance Host Print Application
  • High 8.7
    CVE-2025-34204

    Vasion Print (formerly PrinterLogic) Processes Running as Root Inside Docker Instances

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) contains multiple Docker containers that run primary application processes (for example PHP workers, Node.js servers and custom binaries) as the root user. T…

    Vasion Print Virtual Appliance Host Print Application
  • High 8.6
    CVE-2025-34195

    Vasion Print (formerly PrinterLogic) Unquoted Path During Driver Installation Leads to Execution of C:\Program.exe

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (Windows client deployments) contain a remote code execution vulnerability during driver installation caused by unquoted program paths. Th…

    Vasion Print Virtual Appliance Host Print Application
  • High 8.6
    CVE-2025-34197

    Vasion Print (formerly PrinterLogic) Undocumented Local Account with Hardcoded Password and Passwordless sudo

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.951, Application prior to 20.0.2368 (VA and SaaS deployments) contain an undocumented local user account named ubuntu with a preset password and a sudoers entry granting that a…

    Vasion Print Virtual Appliance Host Print Application
  • High 8.6
    CVE-2025-34200

    Vasion Print (formerly PrinterLogic) Network Account Password Stored in Cleartext

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) provision the appliance with the network account credentials in clear-text inside /etc/issue, and the file is world-readable by default. An attacker with loc…

    Vasion Print Virtual Appliance Host Print Application
  • High 8.5
    CVE-2025-34190

    Vasion Print (formerly PrinterLogic) PrinterInstallerClientService Authentication Bypass via LD_PRELOAD Hooking

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (macOS/Linux client deployments) are vulnerable to an authentication bypass in PrinterInstallerClientService. The service requir…

    Vasion Print Virtual Appliance Host Print Application
  • High 8.5
    CVE-2025-34191

    Vasion Print (formerly PrinterLogic) Arbitrary File Write as Root via Response Path Symlink Follow

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (macOS/Linux client deployments) contain an arbitrary file write vulnerability via the response file handling. When tasks produce output …

    Vasion Print Virtual Appliance Host Print Application
  • High 8.5
    CVE-2025-34194

    Vasion Print (formerly PrinterLogic) Local Privilege Escalation via Insecure Temporary File Handling

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (Windows client deployments) contain an insecure temporary-file handling vulnerability in the PrinterInstallerClient components.…

    Vasion Print Virtual Appliance Host Print Application
  • High 8.5
    CVE-2025-34201

    Vasion Print (formerly PrinterLogic) Lack of Network Segmentation Between Docker Instances

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) run many Docker containers on shared internal networks without firewalling or segmentation between instances. A compromise of any single container allows dir…

    Vasion Print Virtual Appliance Host Print Application
  • High 8.4
    CVE-2025-34188

    Vasion Print (formerly PrinterLogic) Local Log Disclosure of Cleartext Sessions

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (macOS/Linux client deployments) contain a vulnerability in the local logging mechanism. Authentication session tokens, including PHPSESSI…

    Vasion Print Virtual Appliance Host Print Application
  • High 7.1
    CVE-2025-34193

    Vasion Print (formerly PrinterLogic) Insecure Windows Components Lack Modern Memory Protections and Use Outdated Runtimes

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 include Windows client components (PrinterInstallerClientInterface.exe, PrinterInstallerClient.exe, PrinterInstallerClientLaunch…

    Vasion Print Virtual Appliance Host Print Application
  • Medium 6.9
    CVE-2025-34189

    Vasion Print (formerly PrinterLogic) Insecure Inter-Process Communication Allows Local Session Hijacking

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application versions prior to 20.0.1330 (macOS/Linux client deployments) contain a vulnerability in the local inter-process communication (IPC) mechanism. The software s…

    Vasion Print Virtual Appliance Host Print Application

Revision history

  1. #1

    Initiale Fassung

References