CVE-2025-34235: Vasion Print (formerly PrinterLogic) Weak SSL/TLS Certificate Validation RCE
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (Windows client deployments) contain a registry key that can be enabled by administrators, causing the client to skip SSL/TLS certificate validation. An attacker who can intercept HTTPS traffic can then inject malicious driver DLLs, resulting in remote code execution with SYSTEM privileges; a local attacker can achieve local privilege escalation via a junction‑point DLL injection. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34235?
CVE-2025-34235 is considered a medium severity vulnerability due to the potential for SSL/TLS certificate validation bypass.
How do I fix CVE-2025-34235?
To fix CVE-2025-34235, upgrade Vasion Print Virtual Appliance Host to version 25.1.102 or higher and Vasion Print Application to version 25.1.1413 or higher.
What are the risks associated with CVE-2025-34235?
The risks associated with CVE-2025-34235 include potential man-in-the-middle attacks due to the bypass of SSL/TLS certificate validation.
Which versions are affected by CVE-2025-34235?
Versions of Vasion Print Virtual Appliance Host prior to 25.1.102 and Vasion Print Application prior to 25.1.1413 are affected by CVE-2025-34235.
Who can enable the registry key related to CVE-2025-34235?
Administrators can enable the registry key that causes the client to skip SSL/TLS certificate validation in CVE-2025-34235.