CVE-2025-34191
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A vulnerability in Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (macOS/Linux client deployments) allows arbitrary file write via response file handling. The service writes response data into files under /opt/PrinterInstallerClient/tmp/responses/ reusing the requested filename, follows symbolic links, and writes as the service user (typically root), allowing a local unprivileged user to overwrite or create arbitrary files as root.
Risk Assessment
A local attacker can modify configuration files, replace or inject binaries or drivers, leading to local privilege escalation and full system compromise.
Recommendation
Update Vasion Print Virtual Appliance Host to version 22.0.843 or later and Application to version 20.0.1923 or later. Restrict local access to client machines and monitor for unusual writes in /opt/PrinterInstallerClient/tmp/responses/.
Other vulnerabilities in Vasion Print (PrinterLogic) Virtual Appliance
See all- CVE-2025-34232Medium
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.1.102 and Application prior to 25.1.1413 contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_release/lexmark/dellCheck.php script. An unauthenticated attacker can exploit the lack of validation of the printer host address to send requests to internal services.
- CVE-2025-34194High
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (Windows client deployments) contain an insecure temporary-file handling vulnerability in PrinterInstallerClient components. The software creates files as NT AUTHORITY\SYSTEM inside a directory controlled by the local user (C:\Users\%USER%\AppData\Local\Temp\). An attacker who can place symbolic links or influence filenames can cause the service to write to arbitrary filesystem locations as SYSTEM, leading to local privilege escalation.
- CVE-2025-34188High
A vulnerability in the local logging mechanism of Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (macOS/Linux client deployments) stores authentication session tokens (PHPSESSID, XSRF-TOKEN, laravel_session) in cleartext within world-readable log files. Any local user with access to the machine can extract these tokens and use them to authenticate remotely to the SaaS environment, bypassing normal login credentials.
Original NVD description (English source)
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (macOS/Linux client deployments) contain an arbitrary file write vulnerability via the response file handling. When tasks produce output the service writes response data into files under /opt/PrinterInstallerClient/tmp/responses/ reusing the requested filename. The service follows symbolic links in the responses directory and writes as the service user (typically root), allowing a local, unprivileged user to cause the service to overwrite or create arbitrary files on the filesystem as root. This can be used to modify configuration files, replace or inject binaries or drivers, and otherwise achieve local privilege escalation and full system compromise. This vulnerability has been identified by the vendor as: V-2023-019 — Arbitrary File Write as Root.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS