PT-2025-39883 · Unknown · Vasion Print+1

Pierre Barre · Published 2025-09-29 · Updated 2025-10-02 · CVE-2025-34216

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions Vasion Print versions prior to 22.0.1026 Vasion Print Application versions prior to 20.0.2702

Description Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application deployments expose unauthenticated REST API endpoints. These endpoints return configuration files and clear-text passwords, and also disclose the Laravel APP KEY used for cryptographic signing. Obtaining the APP KEY allows an attacker to craft malicious payloads accepted by the application, leading to remote code execution on the appliance. The vendor has identified this as V-2024-018 — RCE & Leaks via API.

Recommendations Update Vasion Print Virtual Appliance Host to version 22.0.1026 or later. Update Vasion Print Application to version 20.0.2702 or later.

Exploit

Fix

RCE

Missing Authentication

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-306

CWE-312

Related Identifiers

CVE-2025-34216

Affected Products

Vasion Print

Vasion Print Application

References · 8

• 🔥 https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-rce-03 · Exploit
• https://osv.dev/vulnerability/CVE-2025-34216 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34216 · Security Note
• https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm · Patch, Vendor Advisory
• https://twitter.com/SecAideInfo/status/1973692913566491002 · Twitter Post
• https://twitter.com/CVEnew/status/1972765973221368087 · Twitter Post
• https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm · Patch, Vendor Advisory
• https://vulncheck.com/advisories/vasion-print-printerlogic-rce-and-password-leaks-via-api · Note