CVE-2025-34190 Vasion Print (formerly PrinterLogic) PrinterInstallerClientService Authentication Bypass via LD_PRELOAD Hooking
Local attackers can bypass authentication in Vasion Print services by hooking geteuid, enabling privilege escalation and execution of administrative commands.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34190?
CVE-2025-34190 is a high-severity authentication bypass vulnerability in Vasion Print Application, published on 19 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (macOS/Linux client deployments) are vulnerable to an authentication bypass in PrinterInstallerClientService. The service requires root privileges for certain administrative operations, but these checks rely on calls to geteuid(). By preloading a malicious shared object overriding geteuid(), a local attacker can trick the service into believing it is running with root privileges. This bypass enables execution of administrative commands (e.g., enabling debug mode, managing configurations, or invoking privileged features) without proper authorization. While some actions requiring write access to protected files may still fail, the flaw effectively breaks the intended security model of the inter-process communication (IPC) system, allowing local attackers to escalate privileges and compromise system integrity. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.
Weakness: CWE-306
Which versions are affected by CVE-2025-34190?
It affects 2 products.
Products include Vasion Virtual Appliance Application, Vasion Virtual Appliance Host.
How do I fix CVE-2025-34190?
No fix has been published for CVE-2025-34190 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-34190 being exploited?
There is no known exploitation of CVE-2025-34190 in the wild and no public exploit code.
Other vulnerabilities in Vasion Print Application
- CVE-2025-34217 Vasion Print (formerly PrinterLogic) Undocumented Hardcoded SSH Key
- CVE-2025-34216 Vasion Print (formerly PrinterLogic) RCE and Password Leaks via API
- CVE-2025-34218 Vasion Print (formerly PrinterLogic) Exposed Internal Docker Instance
- CVE-2025-34221 Vasion Print (formerly PrinterLogic)
- CVE-2025-34222 Vasion Print (formerly PrinterLogic) Unauthenticated Admin APIs Used to Modify SSL Certificates
Sources
Also known as GHSA-4r8x-8q6m-xvvj.