← Back to CVE Explorer

CVE-2025-34194

Full vulnerability record from the local CVENow database.

Description

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (Windows client deployments) contain an insecure temporary-file handling vulnerability in the PrinterInstallerClient components. The software creates files as NT AUTHORITY\SYSTEM inside a directory under the control of the local user (C:\Users\%USER%\AppData\Local\Temp\). An attacker who can place symbolic links or otherwise influence filenames in that directory can cause the service to follow the link and write to arbitrary filesystem locations as SYSTEM. This allows a local, unprivileged user to overwrite or create files as SYSTEM, leading to local privilege escalation and the ability to modify configuration files, replace or inject binaries, or otherwise compromise confidentiality, integrity, and availability of the system. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.

Severity
HIGH
CVSS score
8.5 (v4.0)
Vulnerability status
Modified
Source identifier
[email protected]
Published
2025-09-19 19:15:39.970000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON 
{
  "id": "CVE-2025-34194",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-19T19:15:39.970",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (Windows client deployments) contain an insecure temporary-file handling vulnerability in the PrinterInstallerClient components. The software creates files as NT AUTHORITY\\SYSTEM inside a directory under the control of the local user (C:\\Users\\%USER%\\AppData\\Local\\Temp\\). An attacker who can place symbolic links or otherwise influence filenames in that directory can cause the service to follow the link and write to arbitrary filesystem locations as SYSTEM. This allows a local, unprivileged user to overwrite or create files as SYSTEM, leading to local privilege escalation and the ability to modify configuration files, replace or inject binaries, or otherwise compromise confidentiality, integrity, and availability of the system. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced."
    },
    {
      "lang": "es",
      "value": "Las versiones de Vasion Print (anteriormente PrinterLogic) Virtual Appliance Host anteriores a la 25.1.102 y las versiones de aplicación anteriores a la 25.1.1413 (implementaciones de cliente de Windows) contienen una vulnerabilidad de manejo inseguro de archivos temporales en los componentes de PrinterInstallerClient. El software crea archivos como NT AUTHORITY\\SYSTEM dentro de un directorio bajo el control del usuario local (C:\\Users\\%USER%\\AppData\\Local\\Temp\\). Un atacante que pueda colocar enlaces simbólicos o influir de otro modo en los nombres de archivo en ese directorio puede hacer que el servicio siga el enlace y escriba en ubicaciones arbitrarias del sistema de archivos como SYSTEM. Esto permite a un usuario local sin privilegios sobrescribir o crear archivos como SYSTEM, lo que lleva a una escalada de privilegios local y la capacidad de modificar archivos de configuración, reemplazar o inyectar binarios, o comprometer de otro modo la confidencialidad, integridad y disponibilidad del sistema. Se ha confirmado que esta vulnerabilidad ha sido remediada, pero no está claro cuándo se introdujo el parche."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Vasion",
          "product": "Print Virtual Appliance Host",
          "defaultStatus": "unknown",
          "modules": [
            "PrinterInstallerClient temporary file handling (AppData Local Temp)"
          ],
          "platforms": [
            "Windows"
          ],
          "versions": [
            {
              "version": "0",
              "lessThan": "25.1.102",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Vasion",
          "product": "Print Application",
          "defaultStatus": "unknown",
          "modules": [
            "PrinterInstallerClient temporary file handling (AppData Local Temp)"
          ],
          "platforms": [
            "Windows"
          ],
          "versions": [
            {
              "version": "0",
              "lessThan": "25.1.1413",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-19T20:06:15.677099Z",
          "id": "CVE-2025-34194",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        },
        {
          "lang": "en",
          "value": "CWE-377"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vasion:virtual_appliance_application:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "452CABC4-2EC6-416A-B0EB-4CA8194AB823"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vasion:virtual_appliance_host:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC5493A1-4AB1-43DD-A1F1-A99D9439B884"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#win-lpe-02",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.vulncheck.com/advisories/vasion-print-printerlogic-lpe-via-insecure-temporary-file-handling",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}