Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.1049 and Application versions prior to 20.0.2786 (VA and SaaS deployments) contain insecure defaults and code patterns that disable TLS/SSL certificate verification for communications to printers and internal microservices. In multiple places, the application sets libcurl/PHP transport options such that CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are effectively disabled, and environment variables (for example API_*_VERIFYSSL=false) are used to turn off verification for gateway and microservice endpoints. As a result, the client accepts TLS connections without validating server certificates (and, in some cases, uses clear-text HTTP), permitting on-path attackers to perform man-in-the-middle (MitM) attacks. An attacker able to intercept network traffic between the product and printers or microservices can eavesdrop on and modify sensitive data (including print jobs, configuration, and authentication tokens), inject malicious payloads, or disrupt service.
References
| Link | Resource |
|---|---|
| https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm | Vendor Advisory |
| https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm | Vendor Advisory |
| https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-insecure-communications | Exploit Third Party Advisory |
| https://www.vulncheck.com/advisories/vasion-print-printerlogic-insecure-ssl-verification-allows-mitm-attacks | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
24 Sep 2025, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:vasion:virtual_appliance_application:*:*:*:*:*:*:*:* cpe:2.3:a:vasion:virtual_appliance_host:*:*:*:*:*:*:*:* |
|
| CWE | CWE-295 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
| First Time |
Vasion virtual Appliance Application
Vasion virtual Appliance Host Vasion |
|
| References | () https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm - Vendor Advisory | |
| References | () https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm - Vendor Advisory | |
| References | () https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-insecure-communications - Exploit, Third Party Advisory | |
| References | () https://www.vulncheck.com/advisories/vasion-print-printerlogic-insecure-ssl-verification-allows-mitm-attacks - Third Party Advisory |
19 Sep 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-19 19:15
Updated : 2025-09-24 19:17
NVD link : CVE-2025-34199
Mitre link : CVE-2025-34199
CVE.ORG link : CVE-2025-34199
JSON object : View
Products Affected
vasion
- virtual_appliance_host
- virtual_appliance_application