Executive Summary

CVE-2025-34235 is a critical vulnerability in Vasion Print (formerly PrinterLogic) where a registry key can be enabled by administrators to cause the client to skip SSL/TLS certificate validation. This weakness allows an attacker who can intercept HTTPS traffic to inject malicious driver DLLs, leading to remote code execution with SYSTEM privileges. Additionally, a local attacker can exploit this via junction-point DLL injection to escalate privileges locally. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to remote code execution with SYSTEM privileges if an attacker intercepts HTTPS traffic, allowing them to run arbitrary code on the affected system. It also enables local privilege escalation through DLL injection. The impact includes full compromise of confidentiality, integrity, and availability of the affected system, potentially allowing attackers to control or disrupt printing services and related infrastructure. [1]

Useful 0 Not Useful 0

Detection Guidance

Detection can focus on identifying if the vulnerable versions of Vasion Print Virtual Appliance Host (prior to 25.1.102) or Print Application (prior to 25.1.1413) are in use, and if the registry key that disables SSL/TLS certificate validation is enabled. Specific commands are not provided in the resources, but typical steps include checking installed software versions and inspecting relevant registry keys on Windows clients. Network detection might involve monitoring for unusual HTTPS traffic interception or injection attempts, but no explicit commands are given. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Vasion Print Virtual Appliance Host to version 25.1.102 or later and Print Application to version 25.1.1413 or later to ensure the vulnerability is patched. Additionally, administrators should verify and disable any registry keys that cause the client to skip SSL/TLS certificate validation to prevent man-in-the-middle attacks. Monitoring network traffic for suspicious activity and restricting access to the appliance may also help reduce risk until patches are applied. [1]

Useful 0 Not Useful 0