- Description
- Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.843 and Application prior to version 20.0.1923 (VA/SaaS deployments) possess CI/CD weaknesses: the build pulls an unverified third-party image, downloads the VirtualBox Extension Pack over plain HTTP without signature validation, and grants the jenkins account NOPASSWD for mount/umount. Together these allow supply chain or man-in-the-middle compromise of the build pipeline, injection of malicious firmware, and remote code execution as root on the CI host. This vulnerability has been identified by the vendor as: V-2023-007 — Supply Chain Attack.
- Source
- disclosure@vulncheck.com
- NVD status
- Analyzed
- Products
- virtual_appliance_application, virtual_appliance_host
CVSS 4.0
- Type
- Secondary
- Base score
- 8.7
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- HIGH
CVSS 3.1
- Type
- Primary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
- disclosure@vulncheck.com
- CWE-494
- Hype score
- Not currently trending
I received 43 additional CVEs for Vasion Print vulns: CVE-2025-34208,CVE-2025-34210,CVE-2025-34196, CVE-2025-34207,CVE-2025-34209,CVE-2025-34211,CVE-2025-34212,CVE-2025-34215,CVE-2025-34216,CVE-2025-34217,CVE-2025-34218,CVE-2025-34220,CVE-2025-34221... https://t.co/hwPa77l11j
@PierreKimSec
11 Nov 2025
348 Impressions
2 Retweets
6 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-34212 Supply Chain Attack in Vasion Print Virtual Appliance CI/CD Pipeline Vulnerability https://t.co/YjStivZmXj
@VulmonFeeds
30 Sept 2025
7 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vasion:virtual_appliance_application:*:*:*:*:*:*:*:*",
"matchCriteriaId": "396ACE24-02E9-419D-96C5-D2EE7AE6A963",
"versionEndExcluding": "20.0.1923",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:vasion:virtual_appliance_host:*:*:*:*:*:*:*:*",
"matchCriteriaId": "00B835B0-D67C-443E-A8D0-740F031A99DC",
"versionEndExcluding": "22.0.843",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]