Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions before 25.1.102 and Windows client application versions before 25.1.1413 contain a registry key that, if enabled by administrators, causes the client to bypass SSL/TLS certificate validation. This improper certificate validation (CWE-295) allows an attacker capable of intercepting HTTPS traffic to inject malicious driver DLLs, resulting in remote code execution with SYSTEM privileges. Local attackers can also exploit junction-point DLL injection to escalate privileges locally. The vulnerability has been confirmed fixed, but the precise patch version or date is not specified in the available data.

Successful exploitation allows remote attackers who can intercept HTTPS traffic to execute arbitrary code with SYSTEM privileges on affected systems. Local attackers may escalate privileges via DLL injection. This can lead to full system compromise. The vulnerability is rated critical with a CVSS 4.0 score of 9.5, reflecting high attack vector accessibility and severe impact on confidentiality, integrity, and availability.

The vulnerability has been confirmed as remediated by the vendor, though the exact patch version or date is not specified. Administrators should ensure they are running Vasion Print Virtual Appliance Host version 25.1.102 or later and Windows client application version 25.1.1413 or later. If the registry key that disables certificate validation is enabled, it should be disabled to prevent bypassing SSL/TLS validation. Patch status is not yet confirmed with exact details—check the vendor advisory for current remediation guidance.