Vasion Print Virtual Appliance Host versions before 22.0.1049 and Application versions before 20.0.2786 contain insecure configurations that disable TLS/SSL certificate verification by setting libcurl/PHP options (CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER) to effectively bypass validation. Environment variables like API_*_VERIFYSSL=false further disable verification for gateway and microservice endpoints. This results in the client accepting TLS connections without validating server certificates and sometimes using unencrypted HTTP, enabling on-path attackers to conduct man-in-the-middle attacks. Attackers can intercept, modify, or disrupt communications between the product and printers or microservices, compromising confidentiality and integrity of sensitive data.

The vulnerability allows an unauthenticated attacker positioned on the network path between the Vasion Print Virtual Appliance Host and its printers or internal microservices to intercept and manipulate sensitive data. This includes print jobs, configuration settings, and authentication tokens. The attacker can perform man-in-the-middle attacks, leading to potential data disclosure, data tampering, injection of malicious payloads, or service disruption. The CVSS 4.0 base score of 9.3 reflects the critical severity and the ease of exploitation without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid deploying affected versions or restrict network access to trusted environments to prevent interception. Monitor vendor communications for updates on patches or official mitigations. Do not rely on disabling certificate verification as it exposes the system to significant risk.