CVE-2025-34234: Vasion Virtual Appliance Host hard-coded credentials (CVSS 7.5)

Description

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain two hardcoded private keys that are shipped in the application containers (printerlogic/pi, printerlogic/printer-admin-api, and printercloud/pi). The keys are stored in clear text under /var/www/app/config/ as keyfile.ppk.dev and keyfile.saasid.ppk.dev. The application uses these keys as the symmetric secret for AES‑256‑CBC encryption/decryption of the “SaaS Id” (external identifier) through the getEncryptedExternalId() / getDecryptedExternalId() methods. Because the secret is embedded in the deployed image, any attacker who can obtain a copy of the Docker image, read the configuration files, or otherwise enumerate the filesystem can recover the encryption key. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Vasion Virtual Appliance Application< 25.1.1413

Vasion Virtual Appliance Host< 25.1.102

Remediation

Fixed in

Vasion Virtual Appliance Application≥ 25.1.1413

Vasion Virtual Appliance Host≥ 25.1.102

Patch & vendor advisories

References

https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htmVendor Advisory
https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htmVendor Advisory
https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-hardcoded-keyExploitThird Party Advisory
https://www.vulncheck.com/advisories/vasion-print-printerlogic-hardcoded-encryption-private-keysThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-34234 being actively exploited?

CVE-2025-34234 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.41%.

How severe is CVE-2025-34234?

CVE-2025-34234 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 0.41% probability of exploitation.

Which products are affected by CVE-2025-34234?

Affected products include Vasion Virtual Appliance Application, Vasion Virtual Appliance Host.

How do I fix CVE-2025-34234?

Upgrade affected software to a fixed version, for example Vasion Virtual Appliance Application 25.1.1413, Vasion Virtual Appliance Host 25.1.102 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-34234 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo