PT-2025-38611 · Vasion+1 · Vasion Print Application+2

Pierre Barre · Published 2025-09-19 · Updated 2025-09-20 · CVE-2025-34206

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) (affected versions not specified)

Description The Vasion Print Virtual Appliance Host and Application has overly-permissive filesystem permissions for files under /var/www/efs storage within Docker containers. These files include sensitive data such as secrets.env, GPG-encrypted blobs in .secrets, MySQL client keys, and application session files. An attacker gaining control or access to any container can read or modify these artifacts, potentially leading to credential theft, Remote Code Execution (RCE) via the Laravel APP KEY, Portainer takeover, and full system compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Cleartext Storage of Sensitive Information

Incorrect Permission

Weakness Enumeration

CWE-312

CWE-732

Related Identifiers

CVE-2025-34206

Affected Products

Portainer

Vasion Print Application

Vasion Print Virtual Appliance Host

References · 10

• 🔥 https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-insecure-security-architecture · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34206 · Security Note
• https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm · Vendor Advisory
• https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm · Vendor Advisory
• https://t.me/CVEtracker/32972 · Telegram Post
• https://twitter.com/CveFindCom/status/1969116541707846015 · Twitter Post
• https://twitter.com/CVEnew/status/1969291942723789169 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1969212449443270932 · Twitter Post
• https://twitter.com/offseq/status/1969212688199717217 · Twitter Post
• https://vulncheck.com/advisories/vasion-print-printerlogic-insecure-shared-storage-permissions · Note