What’s Vulnerable › Vulnerabilities

CVE-2025-34235: Vasion Print (formerly PrinterLogic) Weak SSL/TLS Certificate Validation RCE

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-29 · updated 2026-10-18
• Weakness: CWE-295

Description

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (Windows client deployments) contain a registry key that can be enabled by administrators, causing the client to skip SSL/TLS certificate validation. An attacker who can intercept HTTPS traffic can then inject malicious driver DLLs, resulting in remote code execution with SYSTEM privileges; a local attacker can achieve local privilege escalation via a junction‑point DLL injection. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.

Affected products

• Vasion Virtual Appliance Application: before 25.1.1413 — fixed in 25.1.1413
• Vasion Virtual Appliance Host: before 25.1.102 — fixed in 25.1.102

How to fix

Upgrade to a fixed version: Vasion Virtual Appliance Application 25.1.1413; Vasion Virtual Appliance Host 25.1.102. Check the vendor advisory for mitigations.

References

• https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
• https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm
• https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#win-lpe-04
• https://www.vulncheck.com/advisories/vasion-print-printerlogic-weak-ssl-tls-certificate-validation-rce
• https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#win-lpe-04

Get alerted when CVE-2025-34235 or the next vulnerability affects your stack