Skip to content
OpenAdvisories
High WID-SEC-2025-2162 14 CVEs

Vasion Print: Mehrere Schwachstellen

Published Sep 30, 2025 · Updated Sep 30, 2025 · de-DE

Vendor: Vasion Product: Print Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Vasion Print ausnutzen, um sich erhöhte Berechtigungen – sogar Administratorrechte – zu verschaffen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

Product

Vasion Print (ehemals PrintLogic) ist eine Softwarelösung, die das Druckmanagement und die Dokumentenautomatisierung in Unternehmen ermöglicht.

Vulnerabilities 14

  • Critical 10.0
    CVE-2025-34216

    Vasion Print (formerly PrinterLogic) RCE and Password Leaks via API

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (VA deployments only) expose a set of unauthenticated REST API endpoints that return configuration files and clear‑text passwords…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 10.0
    CVE-2025-34217

    Vasion Print (formerly PrinterLogic) Undocumented Hardcoded SSH Key

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) contain an undocumented 'printerlogic' user with a hardcoded SSH public key in '~/.ssh/authorized_keys' and a sudoers rule granting the printerlogic_ssh group 'N…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 10.0
    CVE-2025-34218

    Vasion Print (formerly PrinterLogic) Exposed Internal Docker Instance

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose internal Docker containers through the gw Docker instance. The gateway publishes a /meta endpoint wh…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 10.0
    CVE-2025-34221

    Vasion Print (formerly PrinterLogic)

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 25.2.1518 (VA/SaaS deployments) expose every internal Docker container to the network because firewall rules allow unrestricted traffic to t…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 10.0
    CVE-2025-34222

    Vasion Print (formerly PrinterLogic) Unauthenticated Admin APIs Used to Modify SSL Certificates

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose four admin routes – /admin/hp/cert_upload, /admin/hp/cert_delete, /admin/certs/ca, and /admin/certs/…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 10.0
    CVE-2025-34223

    Vasion Print (formerly PrinterLogic) Insecure Installation Credentials

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) contain a default admin account and an installation‑time endpoint at `/admin/query/update_database.php` tha…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 10.0
    CVE-2025-34224

    Vasion Print (formerly PrinterLogic) Unauthenticated Device Modification

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose a set of PHP scripts under the `console_release` directory without requiring authentication. An unau…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 9.4
    CVE-2025-34209

    Vasion Print (formerly PrinterLogic) Hardcoded GPG Private Key

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.862 and Application prior to 20.0.2014 (VA and SaaS deployments) contain Docker images with the private GPG key and passphrase for the account *no‑reply+virtual‑appliance@printerlogic.c…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 9.4
    CVE-2025-34215

    Vasion Print (formerly PrinterLogic) Unauthenticated Firmware Update Endpoint RCE

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (only VA deployments) expose an unauthenticated firmware-upload flow: a public page returns a signed token usable at va-api/v1/up…

    Vasion Print Virtual Appliance Host Print Application
  • Critical 9.3
    CVE-2025-34211

    Vasion Print (formerly PrinterLogic) Hardcoded SSL Certificate and Private Keys

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA and SaaS deployments) contain a private SSL key and matching public certificate stored in cleartext. The key belongs to the h…

    Vasion Print Virtual Appliance Host Print Application
  • High 8.8
    CVE-2025-34225

    Vasion Print (formerly PrinterLogic) SSRF via console_release Directory

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a server-side request forgery (SSRF) vulnerability. The `console_release` directory is reachable fro…

    Vasion Print Virtual Appliance Host Print Application
  • High 8.7
    CVE-2025-34212

    Vasion Print (formerly PrinterLogic) Insecure Build Pipeline

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.843 and Application prior to version 20.0.1923 (VA/SaaS deployments) possess CI/CD weaknesses: the build pulls an unverified third-party image, downloads the VirtualBox Extensio…

    Vasion Print Virtual Appliance Host Print Application
  • High 7.9
    CVE-2025-34207

    Vasion Print (formerly PrinterLogic) Insecure SSH Client Configuration

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 (VA and SaaS deployments) configure the SSH client within Docker instances with the following options: `UserKnownHostsFile=/dev/null`, `StrictHos…

    Vasion Print Virtual Appliance Host Print Application
  • Medium 6.9
    CVE-2025-34220

    Vasion Print (formerly PrinterLogic) Unauthenticated API Leaks Group Information

    Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contains a /api-gateway/identity/search-groups endpoint that does not require authentication. Requests to ht…

    Vasion Print Virtual Appliance Host Print Application

Revision history

  1. #1

    Initiale Fassung

References