CVE-2025-34191 in Print Virtual Appliance Host
Summary
by MITRE • 09/19/2025
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (macOS/Linux client deployments) contain an arbitrary file write vulnerability via the response file handling. When tasks produce output the service writes response data into files under /opt/PrinterInstallerClient/tmp/responses/ reusing the requested filename. The service follows symbolic links in the responses directory and writes as the service user (typically root), allowing a local, unprivileged user to cause the service to overwrite or create arbitrary files on the filesystem as root. This can be used to modify configuration files, replace or inject binaries or drivers, and otherwise achieve local privilege escalation and full system compromise.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2025
This vulnerability exists within the Vasion Print Virtual Appliance Host software ecosystem, specifically affecting versions prior to 22.0.843 for the host appliance and prior to 20.0.1923 for the macOS/Linux client deployments. The core flaw manifests in the response file handling mechanism where the service processes task output by writing response data to files within the /opt/PrinterInstallerClient/tmp/responses/ directory. The vulnerability stems from the service's failure to properly validate or sanitize filenames during this write operation, creating a path traversal and arbitrary file write condition that directly violates security principles outlined in CWE-22 Path Traversal and CWE-73 Path Traversal. The service operates with elevated privileges as the root user, making the impact of this vulnerability particularly severe.
The technical exploitation of this vulnerability occurs through symbolic link manipulation within the responses directory. An unprivileged local user can create symbolic links with specific names that point to critical system files or directories, then trigger the service to process a response that would normally write to a file with that name. When the service follows these symbolic links and writes data, it effectively overwrites or creates files at arbitrary locations on the filesystem with root privileges. This mechanism directly maps to the ATT&CK technique T1059.001 Command and Scripting Interpreter and T1068 Local Privilege Escalation, as it allows an attacker to bypass normal access controls and achieve elevated system privileges. The vulnerability represents a classic case of insufficient input validation combined with improper privilege management.
The operational impact of this vulnerability extends far beyond simple file modification capabilities. An attacker with local access can leverage this vulnerability to completely compromise the target system by replacing critical configuration files, injecting malicious binaries or drivers, or modifying system components that require root privileges. This creates a persistent backdoor or enables the attacker to escalate privileges to full system control without requiring any additional exploitation steps. The vulnerability affects both the appliance host and client deployments, providing multiple attack vectors for potential compromise. The use of the root service user for file operations means that any file system modification occurs with the highest level of system privileges, making this a critical vulnerability that can lead to complete system takeover.
Mitigation strategies for this vulnerability should focus on immediate patching to versions 22.0.843 or later for the host appliance and 20.0.1923 or later for the client deployments. Organizations should also implement restrictive file system permissions on the /opt/PrinterInstallerClient/tmp/responses/ directory to prevent symbolic link creation by unprivileged users. The service should be configured to not follow symbolic links when processing response files, and all filename inputs should be properly validated and sanitized. Network segmentation and principle of least privilege should be enforced to limit local access to the affected system. Additionally, monitoring should be implemented to detect suspicious file creation patterns or symbolic link manipulation in the affected directories, which would help identify potential exploitation attempts. System administrators should also consider implementing file integrity monitoring solutions to detect unauthorized modifications to critical system files that could result from this vulnerability.