Skip to content
OpenAdvisories
High WID-SEC-2025-2156 9 CVEs

Vasion Print (Virtual Appliance Host und Application): Mehrere Schwachstellen

Published Sep 29, 2025 · Updated Sep 30, 2025 · Revision 2 · de-DE

Vendor: Vasion Product: Print Platform: Windows

Summary

Ein entfernter anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Vasion Print ausnutzen, um serverseitige Request-Forgery-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, beliebigen Code mit SYSTEM-Rechten auszuführen oder erweiterte Rechte zu erlangen.

Product

Vasion Print (ehemals PrintLogic) ist eine Softwarelösung, die das Druckmanagement und die Dokumentenautomatisierung in Unternehmen ermöglicht.

Vulnerabilities 9

  • Critical 9.5
    CVE-2025-34235

    Vasion Print (formerly PrinterLogic) Weak SSL/TLS Certificate Validation RCE

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (Windows client deployments) contain a registry key that can be enabled by administrators, causing the client to skip SSL/TLS cert…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 9.2
    CVE-2025-34234

    Vasion Print (formerly PrinterLogic) Hardcoded Encryption Private Keys

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain two hardcoded private keys that are shipped in the application containers (printerlogic/pi, printerl…

    Vasion Print Virtual Appliance Host Print Application
  • High 8.8
    CVE-2025-34228

    Vasion Print (formerly PrinterLogic) SSRF via Lexmark update.php

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a server-side request forgery (SSRF) vulnerability. The `/var/www/app/console_release/lexmark/update…

    Vasion Print Virtual Appliance Host Print Application
  • High 8.8
    CVE-2025-34231

    Vasion Print (formerly PrinterLogic) SSRF via HP badgeSetup.php

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind and non-blind server-side request forgery (SSRF) vulnerability. The '/var/www/app/console_re…

    Vasion Print Virtual Appliance Host Print Application
  • High 8.5
    CVE-2025-34233

    Vasion Print (formerly PrinterLogic) Insecure Use of file_get_contents()

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a protection mechanism failure vulnerability within the file_get_contents() function. When an admini…

    Vasion Print Virtual Appliance Host Print Application
  • Medium 6.9
    CVE-2025-34229

    Vasion Print (formerly PrinterLogic) Blind SSRF via HP installApp.php

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_rele…

    Vasion Print Virtual Appliance Host Print Application
  • Medium 6.9
    CVE-2025-34230

    Vasion Print (formerly PrinterLogic) Blind SSRF via HP log_off_single_sign_on.php

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_rele…

    Vasion Print Virtual Appliance Host Print Application
  • Medium 6.9
    CVE-2025-34232

    Vasion Print (formerly PrinterLogic) Blind SSRF via Lexmark dellCheck.php

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_rele…

    Vasion Print Virtual Appliance Host Print Application
  • Medium 5.4
    CVE-2025-3422

    Everest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

    The The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.1.1. This is due to the software allowing users to …

    WPEverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Web / CMS

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-31642, EUVD-2025-31644, EUVD-2025-31632, EUVD-2025-31623

  2. #1

    Initiale Fassung

References