PT-2025-39881 · Unknown+1 · Vasion Print+2

Pierre Barre · Published 2025-09-29 · Updated 2025-09-30 · CVE-2025-34212

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vasion Print versions prior to 22.0.843 Vasion Print Application versions prior to 20.0.1923

Description The Vasion Print Virtual Appliance Host and Application have weaknesses in their CI/CD processes. The build process retrieves an unverified third-party image and downloads the VirtualBox Extension Pack over plain HTTP without signature verification. The jenkins account is granted passwordless access for mount and unmount operations. These issues could allow for supply chain compromise, man-in-the-middle attacks, malicious firmware injection, and remote code execution as root on the CI host.

Recommendations Update the Virtual Appliance Host to version 22.0.843 or later. Update the Application to version 20.0.1923 or later.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-494

CWE-732

Related Identifiers

CVE-2025-34212

Affected Products

Vasion Print

Vasion Print Virtual Appliance

Virtualbox Extension Pack

References · 8

• 🔥 https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-supply-chain-build-system · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34212 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34212 · Vendor Advisory
• https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm · Patch, Vendor Advisory
• https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm · Patch, Vendor Advisory
• https://twitter.com/CVEnew/status/1972765976903995604 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1972877121207882111 · Twitter Post
• https://vulncheck.com/advisories/vasion-print-printerlogic-insecure-build-pipeline · Note