VulnerabilityModified

CVE-2025-34189

MEDIUM 6.9EPSS 0.25%

Does this matter?

Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.

Description

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application versions prior to 20.0.1330 (macOS/Linux client deployments) contain a vulnerability in the local inter-process communication (IPC) mechanism. The software stores IPC request and response files inside /opt/PrinterInstallerClient/tmp with world-readable and world-writable permissions. Any local user can craft malicious request files that are processed by privileged daemons, leading to unauthorized actions being executed in other user sessions. This breaks user session isolation, potentially allowing local attackers to hijack sessions, perform unintended actions in the context of other users, and impact system integrity and availability. This vulnerability has been identified by the vendor as: V-2022-004 — Client Inter-process Security.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.25% probability · 16th percentile
CISA KEV: Not listed
Weakness: CWE-732, CWE-922
Affected: vasion/virtual appliance application · vasion/virtual appliance host
Source: disclosure@vulncheck.com

References

https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htmVendor Advisory
https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htmVendor Advisory
https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#mac-lack-auth-communicationExploit, Third Party Advisory
https://www.vulncheck.com/advisories/vasion-print-printerlogic-insecure-interprocess-communicationThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.