CVE-2025-34189: CWE-732 Incorrect Permission Assignment for Critical Resource in Vasion Print Virtual Appliance Host
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application versions prior to 20.0.1330 (macOS/Linux client deployments) contain a vulnerability in the local inter-process communication (IPC) mechanism. The software stores IPC request and response files inside /opt/PrinterInstallerClient/tmp with world-readable and world-writable permissions. Any local user can craft malicious request files that are processed by privileged daemons, leading to unauthorized actions being executed in other user sessions. This breaks user session isolation, potentially allowing local attackers to hijack sessions, perform unintended actions in the context of other users, and impact system integrity and availability. This vulnerability has been identified by the vendor as: V-2022-004 — Client Inter-process Security.
AI Analysis
Technical Summary
Vasion Print Virtual Appliance Host versions before 1.0.735 and Application versions before 20.0.1330 for macOS/Linux have a vulnerability (CVE-2025-34189) due to insecure file permissions on IPC communication files. These files are stored with world-readable and writable permissions, enabling any local user to create malicious IPC request files. Privileged daemons process these files, which can lead to unauthorized execution of actions in other user sessions, violating session isolation. This vulnerability is tracked as V-2022-004 by the vendor and is categorized under CWE-732 (Incorrect Permission Assignment) and CWE-922 (Insecure Storage of Sensitive Information).
Potential Impact
The vulnerability allows local attackers with low privileges to manipulate IPC files that are processed by privileged daemons, potentially hijacking other user sessions and executing unauthorized actions. This compromises user session isolation and can affect system integrity and availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, restrict local user access to the affected directories and monitor for suspicious local activity related to IPC files. Follow vendor updates closely for official fixes.
CVE-2025-34189: CWE-732 Incorrect Permission Assignment for Critical Resource in Vasion Print Virtual Appliance Host
Description
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application versions prior to 20.0.1330 (macOS/Linux client deployments) contain a vulnerability in the local inter-process communication (IPC) mechanism. The software stores IPC request and response files inside /opt/PrinterInstallerClient/tmp with world-readable and world-writable permissions. Any local user can craft malicious request files that are processed by privileged daemons, leading to unauthorized actions being executed in other user sessions. This breaks user session isolation, potentially allowing local attackers to hijack sessions, perform unintended actions in the context of other users, and impact system integrity and availability. This vulnerability has been identified by the vendor as: V-2022-004 — Client Inter-process Security.
CVSS v4.0
Score 6.9medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Vasion Print Virtual Appliance Host versions before 1.0.735 and Application versions before 20.0.1330 for macOS/Linux have a vulnerability (CVE-2025-34189) due to insecure file permissions on IPC communication files. These files are stored with world-readable and writable permissions, enabling any local user to create malicious IPC request files. Privileged daemons process these files, which can lead to unauthorized execution of actions in other user sessions, violating session isolation. This vulnerability is tracked as V-2022-004 by the vendor and is categorized under CWE-732 (Incorrect Permission Assignment) and CWE-922 (Insecure Storage of Sensitive Information).
Potential Impact
The vulnerability allows local attackers with low privileges to manipulate IPC files that are processed by privileged daemons, potentially hijacking other user sessions and executing unauthorized actions. This compromises user session isolation and can affect system integrity and availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, restrict local user access to the affected directories and monitor for suspicious local activity related to IPC files. Follow vendor updates closely for official fixes.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2025-04-15T19:15:22.568Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 68cdaa094b8a032c4fac9ad5
Added to database: 09/19/2025, 19:07:53 UTC
Last enriched: 05/16/2026, 09:18:52 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 155
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.