Vulnerability · Published Sep 29, 2025 · Assigned by VulnCheck

CVE-2025-34235Vasion Print (formerly PrinterLogic) Weak SSL/TLS Certificate Validation RCE

Critical 9.5

In plain English

A critical-severity improper certificate validation in Print Application from Vasion. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 4.0)9.5Critical

Exploit odds (30 days)0.5%top 58.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (Windows client deployments) contain a registry key that can be enabled by administrators, causing the client to skip SSL/TLS certificate validation. An attacker who can intercept HTTPS traffic can then inject malicious driver DLLs, resulting in remote code execution with SYSTEM privileges; a local attacker can achieve local privilege escalation via a junction‑point DLL injection. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.

Affected products (as reported)

Vendor	Product	Versions
Vasion	Print Virtual Appliance Host	0 – before 25.1.102
Vasion	Print Application	0 – before 25.1.1413

Weakness: CWE-295 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#win-lpe-04 technical-description
https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm vendor-advisory, patch
https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm vendor-advisory, patch
https://www.vulncheck.com/advisories/vasion-print-printerlogic-weak-ssl-tls-certificate-validation-rce third-party-advisory