CVE-2025-34216

Unauthenticated REST API endpoints expose configuration files containing passwords in clear-text (CWE-312) without requiring any authentication (CWE-306). Among the disclosed data is the Laravel APP_KEY, which is used for cryptographic signing of requests in the application. An attacker who obtains this key can create malicious, properly signed payloads that the application will recognize as legitimate and execute, leading to remote code execution on the Virtual Appliance device.

An attacker without any authentication can gain full control over the Virtual Appliance device through RCE, as well as obtain all passwords and configuration data stored in the system. Compromise of the print management system can lead to takeover of control over the printing infrastructure of the entire organization and lateral movement in the internal network.

The Virtual Appliance Host must be immediately updated to version 22.0.1026 or later and the Virtual Appliance Application to version 20.0.2702 or later. Until the update is applied, consider restricting network access to the device's REST API endpoints only to trusted hosts using firewall rules. Details are available in the vendor's security bulletins at help.printerlogic.com.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host in versions prior to 22.0.1026 and Virtual Appliance Application in versions prior to 20.0.2702 — only VA (Virtual Appliance) deployments.