PT-2025-39882 · Vasion · Vasion Print Application+1

Pierre Barre · Published 2025-09-29 · Updated 2025-10-02 · CVE-2025-34215

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.1026 Vasion Print (formerly PrinterLogic) Application versions prior to 20.0.2702

Description The Vasion Print Virtual Appliance Host and Application deployments are affected by an unauthenticated firmware-upload flow. A public page provides a signed token usable at the /va-api/v1/update API endpoint. The Docker images contain the appliance’s private GPG key and a hard-coded passphrase. An attacker can extract the key, obtain a token, decrypt, modify, re-sign, upload, and trigger malicious firmware, potentially gaining remote code execution.

Recommendations Update Vasion Print Virtual Appliance Host to version 22.0.1026 or later. Update Vasion Print Application to version 20.0.2702 or later.

Exploit

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-321

CWE-306

Related Identifiers

CVE-2025-34215

Affected Products

Vasion Print Application

Vasion Print Virtual Appliance Host

References · 8

• 🔥 https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-rce-02 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34215 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34215 · Vendor Advisory
• https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm · Vendor Advisory, Patch
• https://twitter.com/CVEnew/status/1972771750195699864 · Twitter Post
• https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm · Vendor Advisory, Patch
• https://vulncheck.com/advisories/vasion-print-printerlogic-unauth-firmware-update-endpoint-rce · Note
• https://twitter.com/SecAideInfo/status/1973692926027792600 · Twitter Post