PT-2023-23676 · Vasion · Vasion Printerlogic Client

Published 2023-07-25 · Updated 2023-08-02 · CVE-2023-32232

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vasion PrinterLogic Client for Windows versions prior to 25.0.0.836

Description An issue was discovered in the Vasion PrinterLogic Client for Windows. During client installation and repair, a PrinterLogic binary is called by the installer to configure the device. This window is not hidden and runs with elevated privileges. A standard user can break out of this window, obtaining a full SYSTEM command prompt window, resulting in complete compromise via arbitrary SYSTEM code execution, which is an elevation of privileges.

Recommendations For versions prior to 25.0.0.836, update to version 25.0.0.836 or later to resolve the issue. As a temporary workaround, consider restricting access to the installer and the PrinterLogic binary to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2023-32232

Affected Products

Vasion Printerlogic Client

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-32232 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32232 · Vendor Advisory
• https://vasion.com/press-releases/printerlogic-rebrands · Vendor Advisory
• https://docs.printercloud.com/1-Printerlogic/Release_Notes/Client_Release_Notes.htm · Note
• https://t.me/cibsecurity/67200 · Telegram Post
• https://docs.printercloud.com/1-Printerlogic/Release_Notes/Security_Bulletin_CVE.htm · Note