https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-34217.htmlhttps://patchthecve.com/cve/CVE-2025-34217.htmlWed, 17 Jun 2026 09:13:40 +0000CRITICAL 9.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) contain an undocumented 'printerlogic' user with a hardcoded SSH public key in '~/.ssh/authorized_keys' and a sudoers rule granting the printerlogic_ssh group 'NOPASSWD: ALL'. Possession of the matchinghttps://patchthecve.com/cve/CVE-2025-34235.htmlhttps://patchthecve.com/cve/CVE-2025-34235.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (Windows client deployments) contain a registry key that can be enabled by administrators, causing the client to skip SSL/TLS certificate validation. An attacker who can ihttps://patchthecve.com/cve/CVE-2025-34234.htmlhttps://patchthecve.com/cve/CVE-2025-34234.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.5: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain two hardcoded private keys that are shipped in the application containers (printerlogic/pi, printerlogic/printer-admin-api, and printercloud/https://patchthecve.com/cve/CVE-2025-34233.htmlhttps://patchthecve.com/cve/CVE-2025-34233.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a protection mechanism failure vulnerability within the file_get_contents() function. When an administrator configures a printer’s hostname (https://patchthecve.com/cve/CVE-2025-34232.htmlhttps://patchthecve.com/cve/CVE-2025-34232.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.3: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_release/lexmark/dellCheck.php script that canhttps://patchthecve.com/cve/CVE-2025-34231.htmlhttps://patchthecve.com/cve/CVE-2025-34231.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 8.6: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind and non-blind server-side request forgery (SSRF) vulnerability. The '/var/www/app/console_release/hp/badgeSetup.php' script is reachahttps://patchthecve.com/cve/CVE-2025-34230.htmlhttps://patchthecve.com/cve/CVE-2025-34230.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_release/hp/log_off_single_sign_on.php script https://patchthecve.com/cve/CVE-2025-34229.htmlhttps://patchthecve.com/cve/CVE-2025-34229.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_release/hp/installApp.php script that can be https://patchthecve.com/cve/CVE-2025-34228.htmlhttps://patchthecve.com/cve/CVE-2025-34228.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 8.6: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a server-side request forgery (SSRF) vulnerability. The `/var/www/app/console_release/lexmark/update.php` script is reachable from the internhttps://patchthecve.com/cve/CVE-2025-34225.htmlhttps://patchthecve.com/cve/CVE-2025-34225.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 8.6: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a server-side request forgery (SSRF) vulnerability. The `console_release` directory is reachable from the internet without any authenticationhttps://patchthecve.com/cve/CVE-2025-34224.htmlhttps://patchthecve.com/cve/CVE-2025-34224.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.1: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose a set of PHP scripts under the `console_release` directory without requiring authentication. An unauthenticated remote attacker can invoke thttps://patchthecve.com/cve/CVE-2025-34223.htmlhttps://patchthecve.com/cve/CVE-2025-34223.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) contain a default admin account and an installation‑time endpoint at `/admin/query/update_database.php` that can be accessed without authentication.https://patchthecve.com/cve/CVE-2025-34222.htmlhttps://patchthecve.com/cve/CVE-2025-34222.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.1: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose four admin routes – /admin/hp/cert_upload, /admin/hp/cert_delete, /admin/certs/ca, and /admin/certs/serviceclients/{scid} – without any authehttps://patchthecve.com/cve/CVE-2025-34221.htmlhttps://patchthecve.com/cve/CVE-2025-34221.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 25.2.1518 (VA/SaaS deployments) expose every internal Docker container to the network because firewall rules allow unrestricted traffic to the Docker bridge network. Because no authhttps://patchthecve.com/cve/CVE-2025-34220.htmlhttps://patchthecve.com/cve/CVE-2025-34220.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 5.3: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contains a /api-gateway/identity/search-groups endpoint that does not require authentication. Requests to https://<tenant>.printercloud10.com/api-gathttps://patchthecve.com/cve/CVE-2025-34218.htmlhttps://patchthecve.com/cve/CVE-2025-34218.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose internal Docker containers through the gw Docker instance. The gateway publishes a /meta endpoint which lists every micro‑service container https://patchthecve.com/cve/CVE-2025-34216.htmlhttps://patchthecve.com/cve/CVE-2025-34216.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (VA deployments only) expose a set of unauthenticated REST API endpoints that return configuration files and clear‑text passwords. The same endpoints also disclose the Lahttps://patchthecve.com/cve/CVE-2025-34215.htmlhttps://patchthecve.com/cve/CVE-2025-34215.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (only VA deployments) expose an unauthenticated firmware-upload flow: a public page returns a signed token usable at va-api/v1/update, and every Docker image contains thehttps://patchthecve.com/cve/CVE-2025-34212.htmlhttps://patchthecve.com/cve/CVE-2025-34212.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.843 and Application prior to version 20.0.1923 (VA/SaaS deployments) possess CI/CD weaknesses: the build pulls an unverified third-party image, downloads the VirtualBox Extension Pack over plain HTTP without signature https://patchthecve.com/cve/CVE-2025-34211.htmlhttps://patchthecve.com/cve/CVE-2025-34211.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 4.9: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA and SaaS deployments) contain a private SSL key and matching public certificate stored in cleartext. The key belongs to the hostname `pl‑local.com` and is used by thehttps://patchthecve.com/cve/CVE-2025-34209.htmlhttps://patchthecve.com/cve/CVE-2025-34209.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.2: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.862 and Application prior to 20.0.2014 (VA and SaaS deployments) contain Docker images with the private GPG key and passphrase for the account *no‑reply+virtual‑appliance@printerlogic.com*. The key is stored in cleartext and thttps://patchthecve.com/cve/CVE-2025-34207.htmlhttps://patchthecve.com/cve/CVE-2025-34207.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 (VA and SaaS deployments) configure the SSH client within Docker instances with the following options: `UserKnownHostsFile=/dev/null`, `StrictHostKeyChecking=no`, and `ForwardAgent yes`.https://patchthecve.com/cve/CVE-2025-34196.htmlhttps://patchthecve.com/cve/CVE-2025-34196.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application prior to 25.1.1413 (Windows client deployments) contain a hardcoded private key for the PrinterLogic Certificate Authority (CA) and a hardcoded password in product configuration files. The Windows https://patchthecve.com/cve/CVE-2025-34206.htmlhttps://patchthecve.com/cve/CVE-2025-34206.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host configuration and secret material under /var/www/efs_storage into many Docker containers with overly-permissive filesystem permissions. Files such as secrets.env, GPG-encrypted blobs in .https://patchthecve.com/cve/CVE-2025-34205.htmlhttps://patchthecve.com/cve/CVE-2025-34205.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (VA and SaaS deployments) contains dangerous PHP dead code present in multiple Docker-hosted PHP instances. A script named /var/www/app/resetroot.php (found in several containershttps://patchthecve.com/cve/CVE-2025-34204.htmlhttps://patchthecve.com/cve/CVE-2025-34204.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) contains multiple Docker containers that run primary application processes (for example PHP workers, Node.js servers and custom binaries) as the root user. This increases the blast radius of a contahttps://patchthecve.com/cve/CVE-2025-34203.htmlhttps://patchthecve.com/cve/CVE-2025-34203.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.1002 and Application versions prior to 20.0.2614 (VA and SaaS deployments) contain multiple Docker containers that include outdated, end-of-life, unsupported, or otherwise vulnerable third-party components (examples: https://patchthecve.com/cve/CVE-2025-34202.htmlhttps://patchthecve.com/cve/CVE-2025-34202.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 8.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518 (VA and SaaS deployments) expose Docker internal networks in a way that allows an attacker on the same external L2 segment — or an attacker able to add routes using the appliance as a gathttps://patchthecve.com/cve/CVE-2025-34201.htmlhttps://patchthecve.com/cve/CVE-2025-34201.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) run many Docker containers on shared internal networks without firewalling or segmentation between instances. A compromise of any single container allows direct access to internal services (HTTP, Rehttps://patchthecve.com/cve/CVE-2025-34200.htmlhttps://patchthecve.com/cve/CVE-2025-34200.htmlWed, 17 Jun 2026 09:13:38 +0000HIGH 7.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) provision the appliance with the network account credentials in clear-text inside /etc/issue, and the file is world-readable by default. An attacker with local shell access can read /etc/issue to ohttps://patchthecve.com/cve/CVE-2025-34199.htmlhttps://patchthecve.com/cve/CVE-2025-34199.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 8.1: Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.1049 and Application versions prior to 20.0.2786 (VA and SaaS deployments) contain insecure defaults and code patterns that disable TLS/SSL certificate verification for communications to printers and internal microserhttps://patchthecve.com/cve/CVE-2025-34198.htmlhttps://patchthecve.com/cve/CVE-2025-34198.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.951 and Application prior to 20.0.2368 (VA and SaaS deployments) contain shared, hardcoded SSH host private keys in the appliance image. The same private host keys (RSA, ECDSA, and ED25519) are present across installahttps://patchthecve.com/cve/CVE-2025-34197.htmlhttps://patchthecve.com/cve/CVE-2025-34197.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.951, Application prior to 20.0.2368 (VA and SaaS deployments) contain an undocumented local user account named ubuntu with a preset password and a sudoers entry granting that account passwordless root privileges (ubunhttps://patchthecve.com/cve/CVE-2025-34195.htmlhttps://patchthecve.com/cve/CVE-2025-34195.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (Windows client deployments) contain a remote code execution vulnerability during driver installation caused by unquoted program paths. The PrinterInstallerClient driver-installathttps://patchthecve.com/cve/CVE-2025-34194.htmlhttps://patchthecve.com/cve/CVE-2025-34194.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (Windows client deployments) contain an insecure temporary-file handling vulnerability in the PrinterInstallerClient components. The software creates files as NT AUTHORIhttps://patchthecve.com/cve/CVE-2025-34193.htmlhttps://patchthecve.com/cve/CVE-2025-34193.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 include Windows client components (PrinterInstallerClientInterface.exe, PrinterInstallerClient.exe, PrinterInstallerClientLauncher.exe) that lack modern compile-time andhttps://patchthecve.com/cve/CVE-2025-34192.htmlhttps://patchthecve.com/cve/CVE-2025-34192.htmlSun, 18 Oct 2026 21:10:00 +0000CRITICAL 9.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.893 and Application versions prior to 20.0.2140 (macOS/Linux client deployments) are built against OpenSSL 1.0.2h-fips (released May 2016), which has been end-of-life since 2019 and is no longer supported by the OpenShttps://patchthecve.com/cve/CVE-2025-34191.htmlhttps://patchthecve.com/cve/CVE-2025-34191.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 8.4: Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (macOS/Linux client deployments) contain an arbitrary file write vulnerability via the response file handling. When tasks produce output the service writes response data into filhttps://patchthecve.com/cve/CVE-2025-34190.htmlhttps://patchthecve.com/cve/CVE-2025-34190.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (macOS/Linux client deployments) are vulnerable to an authentication bypass in PrinterInstallerClientService. The service requires root privileges for certain administrahttps://patchthecve.com/cve/CVE-2025-34189.htmlhttps://patchthecve.com/cve/CVE-2025-34189.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application versions prior to 20.0.1330 (macOS/Linux client deployments) contain a vulnerability in the local inter-process communication (IPC) mechanism. The software stores IPC request and response files insihttps://patchthecve.com/cve/CVE-2025-34188.htmlhttps://patchthecve.com/cve/CVE-2025-34188.htmlSun, 18 Oct 2026 21:10:00 +0000HIGH 7.8: Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (macOS/Linux client deployments) contain a vulnerability in the local logging mechanism. Authentication session tokens, including PHPSESSID, XSRF-TOKEN, and laravel_session, are s