CVE-2025-34194
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (Windows client deployments) contain an insecure temporary-file handling vulnerability in PrinterInstallerClient components. The software creates files as NT AUTHORITY\SYSTEM inside a directory controlled by the local user (C:\Users\%USER%\AppData\Local\Temp\). An attacker who can place symbolic links or influence filenames can cause the service to write to arbitrary filesystem locations as SYSTEM, leading to local privilege escalation.
Risk Assessment
A local unprivileged user could overwrite or create files as SYSTEM, leading to privilege escalation and the ability to modify configuration, replace binaries, or compromise confidentiality, integrity, and availability.
Recommendation
Update Vasion Print Virtual Appliance Host to version 25.1.102 or later and Application to version 25.1.1413 or later.
Other vulnerabilities in Vasion Print (PrinterLogic) Virtual Appliance
See all- CVE-2025-34232Medium
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.1.102 and Application prior to 25.1.1413 contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_release/lexmark/dellCheck.php script. An unauthenticated attacker can exploit the lack of validation of the printer host address to send requests to internal services.
- CVE-2025-34191High
A vulnerability in Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (macOS/Linux client deployments) allows arbitrary file write via response file handling. The service writes response data into files under /opt/PrinterInstallerClient/tmp/responses/ reusing the requested filename, follows symbolic links, and writes as the service user (typically root), allowing a local unprivileged user to overwrite or create arbitrary files as root.
- CVE-2025-34188High
A vulnerability in the local logging mechanism of Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (macOS/Linux client deployments) stores authentication session tokens (PHPSESSID, XSRF-TOKEN, laravel_session) in cleartext within world-readable log files. Any local user with access to the machine can extract these tokens and use them to authenticate remotely to the SaaS environment, bypassing normal login credentials.
Original NVD description (English source)
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (Windows client deployments) contain an insecure temporary-file handling vulnerability in the PrinterInstallerClient components. The software creates files as NT AUTHORITY\SYSTEM inside a directory under the control of the local user (C:\Users\%USER%\AppData\Local\Temp\). An attacker who can place symbolic links or otherwise influence filenames in that directory can cause the service to follow the link and write to arbitrary filesystem locations as SYSTEM. This allows a local, unprivileged user to overwrite or create files as SYSTEM, leading to local privilege escalation and the ability to modify configuration files, replace or inject binaries, or otherwise compromise confidentiality, integrity, and availability of the system. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS