Vasion Print (formerly PrinterLogic) Usage of Outdated and Unsupported OpenSSL Version
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.893 and Application versions prior to 20.0.2140 (macOS/Linux client deployments) are built against OpenSSL 1.0.2h-fips (released May 2016), which has been end-of-life since 2019 and is no longer supported by the OpenSSL project. Continued use of this outdated cryptographic library exposes deployments to known vulnerabilities that are no longer patched, weakening the overall security posture. Affected daemons may emit deprecation warnings and rely on cryptographic components with unresolved security flaws, potentially enabling attackers to exploit weaknesses in TLS/SSL processing or cryptographic operations. This vulnerability has been identified by the vendor as: V-2023-021 — Out-of-Date OpenSSL Library.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Vasion | Print Virtual Appliance Host | before 22.0.893 | 22.0.893 | Patch available | CNA |
| Vasion | Print Application | before 20.0.2140 | 20.0.2140 | Patch available | CNA |
- Print Virtual Appliance Host VendorVasion Affected before 22.0.893 Fixed in 22.0.893 Patch available CNA
- Print Application VendorVasion Affected before 20.0.2140 Fixed in 20.0.2140 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vasion:virtual_appliance_application:*:*:*:*:*:*:*:* | before 20.0.2140 | Vulnerable | Vasion |
| cpe:2.3:a:vasion:virtual_appliance_host:*:*:*:*:*:*:*:* | before 22.0.893 | Vulnerable | Vasion |
| cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
- cpe:2.3:a:vasion:virtual_appliance_application:*:*:*:*:*:*:*:* Versions before 20.0.2140 Vulnerable ·Vasion
- cpe:2.3:a:vasion:virtual_appliance_host:*:*:*:*:*:*:*:* Versions before 22.0.893 Vulnerable ·Vasion
- cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
Remediation
- Fix · CNA Print Virtual Appliance Host (Vasion) Fixed in 22.0.893
- Fix · CNA Print Application (Vasion) Fixed in 20.0.2140
Timeline
- 2026-10-02 Threatist record created from CVE-2025-34192
- 2026-10-03 Alias added: GHSA-c878-94h7-33g3
References
More Vasion Virtual Appliance Application vulnerabilities
- TI-2025-24370 Vasion Print (formerly PrinterLogic) Unauthenticated Device Modification CVSS 4.0CRITICAL 10.0
- TI-2025-24369 Vasion Print (formerly PrinterLogic) Insecure Installation Credentials CVSS 4.0CRITICAL 10.0
- TI-2025-24368 Vasion Print (formerly PrinterLogic) Unauthenticated Admin APIs Used to Modify SSL Certificates CVSS 4.0CRITICAL 10.0
- TI-2025-24367 Missing authentication in Vasion Print Virtual Appliance Host CVSS 4.0CRITICAL 10.0
- TI-2025-24364 Vasion Print (formerly PrinterLogic) Undocumented Hardcoded SSH Key CVSS 4.0CRITICAL 10.0
- TI-2025-24363 Vasion Print (formerly PrinterLogic) RCE and Password Leaks via API CVSS 4.0CRITICAL 10.0
Sources
- CVE-2025-34192 · CVE Program
- CVE-2025-34192 · NVD
- FIRST EPSS
- GHSA-c878-94h7-33g3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences