External risk intelligence

Vasion Print Insecure Communication Allows Man-in-the-Middle Attacks

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-34199

The vulnerability involves internal communications between the printer management application, internal printers, and internal microservices. While the application itself may be network-connected, the specific vulnerable traffic path occurs within the internal network infrastructure to facilitate backend operations, making direct public internet exposure of these specific insecure communication channels uncommon.

Vasion Virtual Appliance Application

before 20.0.2786before 22.0.1049

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Vasion Print's virtual appliance and application that allows for man-in-the-middle attacks, potentially exposing sensitive data and enabling malicious activity. The issue stems from the product's default configuration and code patterns that disable secure communication verification.

Insecure defaults allow data interception and modification.
Leadership should remember the risk to sensitive print data.
Confirm if this print management tool is in use.

Attack Path

How an attacker could exploit the issue

An attacker can intercept network traffic between the Vasion Print virtual appliance and its printers or internal services. This allows them to view or alter sensitive data, insert malicious code, or disrupt services by exploiting the product's failure to verify TLS/SSL certificates.

Intercept network traffic.
Disable TLS/SSL certificate verification.
Eavesdrop, modify data, inject payloads.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to intercept and modify sensitive data exchanged between the Vasion Print application and printers or internal services when network traffic is not properly secured. This occurs because the application may disable TLS/SSL certificate verification, enabling man-in-the-middle attacks.

Print jobs and authentication tokens at risk.
On-path network interception.
Data eavesdropping and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application are susceptible to Man-in-the-Middle attacks due to disabled TLS/SSL certificate verification. This allows attackers to intercept and modify sensitive data, including print jobs and authentication tokens, or disrupt services. Responsibility likely falls to application owners, infrastructure teams, and potentially network/security teams to identify affected deployments, confirm business criticality and reachability, and then coordinate remediation.

Application and Infrastructure teams own remediation.
Verify affected deployments and business criticality.
Plan vendor coordination and maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Vasion Print and how is it used?

Vasion Print, formerly known as PrinterLogic, is a print management solution. It uses virtual appliances and SaaS applications to centralize the management of printers, drivers, and print queues across an organization's network, streamlining how users send jobs to various output devices.

What does CVE-2025-34199 mean for software security?

This vulnerability is classified as CWE-295, or Improper Certificate Validation. It means the software does not properly check if the digital certificates presented by printers or internal services are authentic. Because these security checks are disabled, the application cannot confirm it is talking to a trusted device, allowing an attacker to intercept or alter communications.

How does an attacker trigger this vulnerability?

An attacker triggers this by positioning themselves on the network path between the Vasion Print server and its printers or internal microservices. If they can intercept this traffic, the application's failure to verify encryption certificates allows the attacker to conduct a man-in-the-middle attack. This bug is not triggered by public internet traffic alone, but rather by traffic flowing across the internal network segments where the appliance operates.

Is my organization at risk if Vasion Print is not on the public internet?

Halo Surface Signal notes that while the application may have internet connectivity, this specific vulnerability targets internal traffic between the appliance and printers or backend services. Since the exploit path relies on intercepting internal network communications, the risk remains relevant even for non-internet-facing deployments if an attacker gains a foothold within your local network infrastructure.

What steps should I take to address this issue?

Your first step is to confirm if your organization runs Vasion Print (PrinterLogic) and identify the specific version of your virtual appliance or application. Review the vendor's security bulletins to understand the update path for your deployment. Coordinate with your infrastructure or application management teams to schedule the necessary software updates to versions 22.0.1049 or 20.0.2786 and above to restore proper TLS/SSL certificate verification.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.