CVE-2025-34212
HIGH EPSS 45.5%
Published Sep 29, 20259mo ago · Modified Jun 17, 20262w ago
8.7 CVSS 4.0
Published Sep 29, 2025 9mo ago
Last Modified Jun 17, 2026 2w ago
Description
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.843 and Application prior to version 20.0.1923 (VA/SaaS deployments) possess CI/CD weaknesses: the build pulls an unverified third-party image, downloads the VirtualBox Extension Pack over plain HTTP without signature validation, and grants the jenkins account NOPASSWD for mount/umount. Together these allow supply chain or man-in-the-middle compromise of the build pipeline, injection of malicious firmware, and remote code execution as root on the CI host. This vulnerability has been identified by the vendor as: V-2023-007 — Supply Chain Attack.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
45.5% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available
Weaknesses 2
CWE-494
CWE-732
Affected Products 2
References 4
- help.printerlogic.com https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
- help.printerlogic.com https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm
- pierrekim.github.io https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-supply-chain-build-system
- vulncheck.com https://www.vulncheck.com/advisories/vasion-print-printerlogic-insecure-build-pipeline
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.