CyberSecBulletin
CVE-2025-34192NVD status: Modified

Print Virtual Appliance Host: Use of Unmaintained Third Party Components

Published Updated By the CyberSecBulletin desk

CVE-2025-34192 is a critical-severity use of unmaintained third party components vulnerability in Print Virtual Appliance Host from Vasion, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version 22.0.893 as the first without the flaw, so updating Print Virtual Appliance Host to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.96% chance of exploitation within 30 days, higher than 62% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Print Virtual Appliance Host to 22.0.893 or a later version.
  2. Update Print Application to 20.0.2140 or a later version.
  3. Update Virtual Appliance Application to 20.0.2140 or a later version.
  4. Read the advisory on help.printerlogic.com for workarounds and exact fixed builds.
  5. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
VasionPrint Virtual Appliance Hostbefore 22.0.89322.0.893
VasionPrint Applicationbefore 20.0.214020.0.2140
VasionVirtual Appliance Applicationbefore 20.0.214020.0.2140
VasionVirtual Appliance Hostbefore 22.0.89322.0.893

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 4.09.3CriticalCNA (vulncheck.com)
CVSS 3.19.8CriticalNVD

Official description

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.893 and Application versions prior to 20.0.2140 (macOS/Linux client deployments) are built against OpenSSL 1.0.2h-fips (released May 2016), which has been end-of-life since 2019 and is no longer supported by the OpenSSL project. Continued use of this outdated cryptographic library exposes deployments to known vulnerabilities that are no longer patched, weakening the overall security posture. Affected daemons may emit deprecation warnings and rely on cryptographic components with unresolved security flaws, potentially enabling attackers to exploit weaknesses in TLS/SSL processing or cryptographic operations. This vulnerability has been identified by the vendor as: V-2023-021 — Out-of-Date OpenSSL Library.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use of Unmaintained Third Party Components

The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.

More Use of Unmaintained Third Party Components vulnerabilities (CWE-1104)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Technical write-ups (may include proof of concept)

Other vulnerabilities in Print Virtual Appliance Host

All Print Virtual Appliance Host vulnerabilities

Recent Use of Unmaintained Third Party Components vulnerabilities

Spotted an error? Tell us.