CVE-2025-34189: Vasion Print (formerly PrinterLogic) Insecure Inter-Process Communication Allows Local Session Hijacking
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application versions prior to 20.0.1330 (macOS/Linux client deployments) contain a vulnerability in the local inter-process communication (IPC) mechanism. The software stores IPC request and response files inside /opt/PrinterInstallerClient/tmp with world-readable and world-writable permissions. Any local user can craft malicious request files that are processed by privileged daemons, leading to unauthorized actions being executed in other user sessions. This breaks user session isolation, potentially allowing local attackers to hijack sessions, perform unintended actions in the context of other users, and impact system integrity and availability. This vulnerability has been identified by the vendor as: V-2022-004 — Client Inter-process Security.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34189?
CVE-2025-34189 is classified with a moderate severity due to its impact on local inter-process communication security.
How do I fix CVE-2025-34189?
To mitigate CVE-2025-34189, upgrade to Vasion Print versions 1.0.735 or later and Vasion Print Application versions 20.0.1330 or later.
What vulnerabilities does CVE-2025-34189 exploit?
CVE-2025-34189 exploits vulnerabilities in the local inter-process communication (IPC) mechanism in the affected software.
Who is affected by CVE-2025-34189?
Vasion Print and Vasion Print Application users with versions prior to 1.0.735 and 20.0.1330, respectively, are affected by CVE-2025-34189.
What are the implications of CVE-2025-34189?
The implications of CVE-2025-34189 include potential unauthorized access and communication vulnerabilities within the software environment.