PT-2025-39879 · Printerlogic · Vasion Print Application+2

Pierre Barre · Published 2025-09-29 · Updated 2025-09-29 · CVE-2025-34209

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Vasion Print versions prior to 22.0.862 Vasion Print Application versions prior to 20.0.2014

Description The Vasion Print Virtual Appliance Host and Application contain Docker images with a private GPG key and its passphrase stored in cleartext. The key belongs to the account no‑reply+virtual‑[e-mail]. An attacker with administrative access can extract the private key and use it to decrypt GPG-encrypted files and sign malicious firmware update packages. A successfully uploaded and executed malicious update grants the attacker full control of the virtual appliance. The vulnerable key is hardcoded in files.

Recommendations Update Vasion Print Virtual Appliance Host to version 22.0.862 or later. Update Vasion Print Application to version 20.0.2014 or later.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-34209

Affected Products

Vasion Print

Vasion Print Application

Vasion Print Virtual Appliance Host

References · 8

• 🔥 https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-private-gpg-key · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34209 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34209 · Vendor Advisory
• https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm · Patch, Vendor Advisory
• https://twitter.com/CveFindCom/status/1972763304087978369 · Twitter Post
• https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm · Patch, Vendor Advisory
• https://vulncheck.com/advisories/vasion-print-printerlogic-hardcoded-gpg-private-key · Note
• https://twitter.com/CVEnew/status/1972765978850127886 · Twitter Post