NVD disclosure day
CVE-2025-59689
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in Libraesva Email Security Gateway allows command injection via compressed email attachments. This could permit unauthorized command execution, potentially leading to data access or service disruption. The risk warrants attention to protect affected organizations.
CVE-2025-34206
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Overly permissive filesystem permissions in Vasion Print (formerly PrinterLogic) virtual appliances and SaaS deployments allow access to sensitive files like secrets and credentials from multiple containers. This could lead to credential theft, remote code execution, or a full system compromise.
CVE-2025-34205
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Dangerous PHP dead code in Vasion Print's virtual appliance and application software allows unauthenticated attackers to reset database administrator credentials, potentially leading to remote code execution and full system compromise.
CVE-2025-34203
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
Vasion Print's virtual appliance and application are affected by outdated, unsupported third-party components, increasing the attack surface and enabling exploitation chains. These vulnerabilities could allow an attacker to compromise the system if it is reachable.
CVE-2025-34199
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
Vasion Print's virtual appliance and application can be compromised by man-in-the-middle attacks due to insecure defaults that disable TLS/SSL certificate verification, allowing attackers to intercept and alter sensitive data like print jobs and authentication tokens.
CVE-2025-34198
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
Vasion Print virtual appliances contain shared, hardcoded SSH keys, allowing an attacker to impersonate an appliance, intercept, or decrypt SSH connections. This could enable man-in-the-middle attacks against administrative sessions. Organizations should verify if this technology is deployed and accessible in their env
CVE-2025-34192
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
The Vasion Print virtual appliance and application use an outdated, unsupported OpenSSL library, exposing them to unpatched security flaws. Reachable deployments may allow attackers to exploit weaknesses in cryptographic operations, potentially compromising security. Confirming relevance and network exposure is crucial
CVE-2025-48703
Halo Surface Signal: 5 out of 5 — more likely to be public-facing.
A vulnerability in Control Web Panel allows unauthenticated remote code execution. Attackers can exploit this with a known username, potentially leading to unauthorized system control and data compromise. This presents a significant business risk.