PT-2025-38591 · Vasion · Vasion Print Application+1

Pierre Barre · Published 2025-09-19 · Updated 2025-10-02 · CVE-2025-34188

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vasion Print Virtual Appliance Host versions prior to 1.0.735 Vasion Print Application versions prior to 20.0.1330

Description The local logging mechanism in Vasion Print contains a security issue where authentication session tokens, including PHPSESSID, XSRF-TOKEN, and laravel session, are stored in cleartext within world-readable log files. A local user with access to the machine can extract these session tokens and use them to authenticate remotely to the SaaS environment, potentially leading to unauthorized system access and exposure of sensitive information.

Recommendations Update Vasion Print Virtual Appliance Host to version 1.0.735 or later. Update Vasion Print Application to version 20.0.1330 or later.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-34188

Affected Products

Vasion Print Application

Vasion Print Virtual Appliance Host

References · 9

• 🔥 https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#mac-leak-secrets · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34188 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34188 · Vendor Advisory
• https://t.me/cveNotify/137259 · Telegram Post
• https://vulncheck.com/advisories/vasion-print-printerlogic-local-log-disclosure-of-cleartext-sessions · Note
• https://twitter.com/CVEnew/status/1969291946901242031 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1969255963942064384 · Twitter Post
• https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm · Patch, Vendor Advisory
• https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm · Patch, Vendor Advisory