CVE-2025-34216: Critical Unauthenticated API Leaks in Vasion Print

CVE-2025-34216 is a critical (CVSS 9.8) flaw in Vasion Print, formerly PrinterLogic, affecting virtual appliance deployments only. The record says host before 22.0.1026 and application before 20.0.2702 are affected, so move to those releases or later. Confirm the exact releases in the vendor bulletin.

What's affected

The record covers Vasion Print (formerly PrinterLogic), virtual appliance deployments only. The record says host before 22.0.1026 and application before 20.0.2702 are affected, so the fix is in those releases or later.

The record is one of a group published on the same day from an outside research report of 83 issues in the product, and the vendor tracks each under its own bulletin number (V-2024-018, RCE and Leaks via API). The vendor bulletin page needs a modern browser and could not be read automatically for this post, so check it directly for the exact releases that apply to your deployment.

What the record describes: Unauthenticated REST API endpoints return configuration files and clear text passwords, and disclose the Laravel APP_KEY used for signing, which lets an attacker craft requests the application accepts.

How to check if you're exposed

Start with the product version. In the Vasion Print administration console, read the version of the Virtual Appliance Host and of the Application, or for client deployments check the installed client version. Compare each against the limits above.

If the deployment is SaaS hosted by the vendor, the vendor is responsible for the server side, so ask the vendor to confirm the fix is applied to your tenant. For the Virtual Appliance, also review which networks can reach the appliance web and SSH ports.

This is a shipped product or appliance, not a package you import, so a manifest scan will not list it. Use your asset inventory, procurement records or network discovery to find every instance, then compare the version you find against the fixed version in the vendor notes. Safeguard's free in-browser dependency scan and the Gold directory are useful for the open source parts of your estate, and you can look up this CVE in Gold to see how it is tracked.

What to do now

1. List every Vasion Print Virtual Appliance and client deployment and record the version.
2. Upgrade to the fixed release in the vendor bulletin. The record says host before 22.0.1026 and application before 20.0.2702 are affected, so move to those releases or later.
3. Read the vendor security bulletins for the whole group of related CVEs and plan one upgrade that covers them.
4. Restrict network access to the appliance to the print servers, admins and clients that need it, and keep it off the public internet.
5. Rotate credentials, keys and certificates that the product holds once you are on a fixed release, where the issue involves secrets.
6. Review appliance and network logs for unexpected admin activity from before the upgrade.

Why it matters

The record ties this to CWE-306 (Missing Authentication for Critical Function), CWE-312 (Cleartext Storage of Sensitive Information). In plain terms, unauthenticated REST API endpoints return configuration files and clear text passwords, and disclose the Laravel APP_KEY used for signing, which lets an attacker craft requests the application accepts.

A leaked signing key lets an attacker produce payloads the application treats as genuine, leading to code execution per the record. The record gives a score of 9.8, with network access and no privileges needed. It does not flag the CVE as exploited in the wild and it is not on the CISA KEV list. The vendor identifies this item as V-2024-018, RCE and Leaks via API. Because the same product has many findings of this kind, treat the whole bulletin set as one upgrade project.

Quick check

Sources

• Vasion Print security bulletins (needs a browser, could not be read automatically)
• Appliance bulletins
• Original research report cited in the record

Last reviewed: 18 October 2026.