Cyber Posture

CVE-2025-34193

CriticalPublic PoC

Published: 19 September 2025

Published
19 September 2025
Modified
29 September 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0029 52.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-34193 is a critical-severity Improper Handling of Exceptional Conditions (CWE-755) vulnerability in Vasion Virtual Appliance Application. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 47.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires implementation of memory protections such as DEP, ASLR, CFG, and stack protection that are absent in the vulnerable binaries, preventing memory corruption exploits.

prevent

Prohibits the use of unsupported system components like outdated Python 2 and legacy Pascal/Delphi runtimes, eliminating deployment of the vulnerable binaries.

prevent

Ensures timely identification, reporting, and patching of the specific flaw in affected Vasion Print versions, as confirmed by vendor remediation.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Insecure Windows client binaries (PrinterInstallerClient*.exe) lack modern exploit mitigations (DEP, ASLR, CFG, stack protection), use outdated runtimes, run as SYSTEM, and process downloaded drivers, enabling memory corruption exploits for client execution (T1203) and privilege escalation to SYSTEM (T1068).

NVD Description

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 include Windows client components (PrinterInstallerClientInterface.exe, PrinterInstallerClient.exe, PrinterInstallerClientLauncher.exe) that lack modern compile-time and runtime exploit mitigations and rely on outdated runtimes. These binaries are…

more

built as 32-bit, without Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), Control Flow Guard (CFG), or stack-protection, and they incorporate legacy technologies (Pascal/Delphi and Python 2) which are no longer commonly maintained. Several of these processes run with elevated privileges (NT AUTHORITY\SYSTEM for PrinterInstallerClient.exe and PrinterInstallerClientLauncher.exe), and the client automatically downloads and installs printer drivers. The absence of modern memory safety mitigations and the use of unmaintained runtimes substantially increase the risk that memory-corruption or other exploit primitives — for example from crafted driver content or maliciously crafted inputs — can be turned into remote or local code execution and privilege escalation to SYSTEM. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.

Deeper analysisAI

CVE-2025-34193 affects Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413. The vulnerability stems from Windows client components, including PrinterInstallerClientInterface.exe, PrinterInstallerClient.exe, and PrinterInstallerClientLauncher.exe, that lack modern compile-time and runtime exploit mitigations such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), Control Flow Guard (CFG), and stack-protection. These 32-bit binaries rely on outdated runtimes like Pascal/Delphi and Python 2, which are no longer commonly maintained. Processes such as PrinterInstallerClient.exe and PrinterInstallerClientLauncher.exe run with elevated NT AUTHORITY\SYSTEM privileges, and the client automatically downloads and installs printer drivers, heightening exposure to memory corruption risks (associated with CWE-755 and CWE-1104). The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Unauthenticated attackers on the network can exploit this vulnerability with low complexity and no user interaction required. By leveraging crafted driver content or malicious inputs, adversaries could trigger memory-corruption primitives, potentially leading to remote or local code execution and privilege escalation to SYSTEM level.

Vendor security bulletins at help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm and help.printerlogic.com/va/Print/Security/Security-Bulletins.htm confirm remediation, though the exact patch introduction date is unclear; affected users should upgrade to Virtual Appliance Host 25.1.102 or later and Application 25.1.1413 or later. Additional analysis appears in Pierre Kim's blog post on 83 Vasion/PrinterLogic vulnerabilities and VulnCheck's advisory on insecure Windows components.

Details

CWE(s)

Affected Products

vasion
virtual appliance application
all versions
vasion
virtual appliance host
all versions

CVEs Like This One

CVE-2025-34195Same product: Microsoft Windows
CVE-2025-34204Same product: Vasion Virtual Appliance Application
CVE-2025-34205Same product: Vasion Virtual Appliance Application
CVE-2025-34218Same product: Vasion Virtual Appliance Application
CVE-2025-34216Same product: Vasion Virtual Appliance Application
CVE-2025-34221Same product: Vasion Virtual Appliance Application
CVE-2025-34215Same product: Vasion Virtual Appliance Application
CVE-2025-34223Same product: Vasion Virtual Appliance Application
CVE-2025-34207Same product: Vasion Virtual Appliance Application
CVE-2025-34203Same product: Vasion Virtual Appliance Application

References