CVE-2025-34195
📋 TL;DR
This vulnerability allows remote code execution on Windows systems running vulnerable versions of Vasion Print (formerly PrinterLogic). Attackers can exploit unquoted program paths during driver installation to execute arbitrary code with elevated privileges, potentially compromising affected endpoints. Organizations using Vasion Print Virtual Appliance Host versions before 1.0.735 or Application versions before 20.0.1330 on Windows are affected.
💻 Affected Systems
- Vasion Print (formerly PrinterLogic) Virtual Appliance Host
- Vasion Print (formerly PrinterLogic) Application
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative privileges, enabling lateral movement, data exfiltration, ransomware deployment, and complete control over affected endpoints.
Likely Case
Privilege escalation leading to persistent backdoor installation, credential theft, and establishment of foothold for further network exploitation.
If Mitigated
Limited impact with proper network segmentation, endpoint protection, and least privilege principles in place, potentially containing the attack to isolated segments.
🎯 Exploit Status
Exploitation requires ability to place malicious executable at specific short-path location; detailed technical analysis available in public references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Virtual Appliance Host 1.0.735 or later, Application 20.0.1330 or later
Vendor Advisory: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
Restart Required: Yes
Instructions:
1. Download and install the patched version from official vendor sources. 2. Restart affected systems. 3. Verify installation by checking version numbers.
🔧 Temporary Workarounds
Restrict file creation in vulnerable directories
windowsApply strict file system permissions to prevent unauthorized file creation in C:\Program Files (x86)\Printer Properties Pro\Printer Installer and parent directories.
icacls "C:\Program Files (x86)\Printer Properties Pro\Printer Installer" /deny Everyone:(OI)(CI)F
icacls "C:\Program Files (x86)\Printer Properties Pro" /deny Everyone:(OI)(CI)F
Monitor for suspicious file creation
windowsImplement file system monitoring for executable creation in vulnerable paths.
🧯 If You Can't Patch
- Isolate affected systems from critical network segments using firewall rules and network segmentation.
- Implement application allowlisting to prevent execution of unauthorized binaries from vulnerable directories.
🔍 How to Verify
Check if Vulnerable:
Check installed version of Vasion Print/PrinterLogic software; if Virtual Appliance Host version is below 1.0.735 or Application version is below 20.0.1330, system is vulnerable.Check Version:
Check application version in Control Panel > Programs and Features or via vendor-specific management console.Verify Fix Applied:
Confirm installed version meets or exceeds patched versions (1.0.735 for Virtual Appliance Host, 20.0.1330 for Application).📡 Detection & Monitoring
Log Indicators:
- Process creation events from C:\Program.exe or similar short-path executables
- File creation events in C:\Program Files (x86)\Printer Properties Pro\Printer Installer directory
- Unusual process execution from PrinterInstallerClient component
Network Indicators:
- Unexpected outbound connections from systems running Vasion Print software
- Network traffic to/from vulnerable systems during driver installation processes
SIEM Query:
Process Creation where (ImagePath contains "C:\\Program.exe" OR CommandLine contains "Printer Installer") AND ParentImage contains "PrinterInstallerClient"🔗 References
- https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
- https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm
- https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#win-rce-01
- https://www.vulncheck.com/advisories/vasion-print-printerlogic-unquoted-path-during-driver-installation
