CVE-2025-34215

The public application page returns a signed token authorizing the invocation of the va-api/v1/update endpoint. At the same time, each Docker image contains the appliance's private GPG key along with a hardcoded password (CWE-321), which enables decryption of the original firmware. An attacker who obtains the key and token can modify the firmware, re-sign it, upload it to the endpoint, and trigger its installation — thereby gaining full RCE. The absence of any authentication mechanism when retrieving the token (CWE-306) makes the attack available to anyone with network access to the appliance.

An attacker gains remote code execution (RCE) at the appliance level, which can lead to full takeover of the virtual system, its container environment, and potentially the entire print infrastructure.

Update Virtual Appliance Host to version 22.0.1026 or newer and Virtual Appliance Application to version 20.0.2702 or newer. Detailed information is available in the vendor's security bulletins at help.printerlogic.com. Until the patch is deployed, it is recommended to restrict network access to the va-api/v1/update endpoint at the firewall level.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions earlier than 22.0.1026 and Virtual Appliance Application versions earlier than 20.0.2702 — VA (Virtual Appliance) deployments only.