PT-2025-39985 · Vasion · Vasion Print Application+1

Pierre Barre · Published 2025-09-30 · Updated 2025-10-07 · CVE-2025-34217

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) (affected versions not specified)

Description The Vasion Print Virtual Appliance Host and Application contains an undocumented user, printerlogic, with a hardcoded SSH public key located in the ~/.ssh/authorized keys file. A sudoers rule grants the printerlogic ssh group ‘NOPASSWD: ALL’ privileges. Possession of the corresponding private key grants an attacker root access to the appliance.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2025-34217

Affected Products

Vasion Print Application

Vasion Print Virtual Appliance Host

References · 10

• 🔥 https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-undocumented-hardcoded-ssh-key · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34217 · Security Note
• https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm · Patch, Vendor Advisory
• https://twitter.com/CveFindCom/status/1973019983576699178 · Twitter Post
• https://twitter.com/0dayPublishing/status/1973015915731042791 · Twitter Post
• https://vulncheck.com/advisories/vasion-print-printerlogic-incorrect-encryption-algorithms-used-to-store-passwords · Note
• https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm · Patch, Vendor Advisory
• https://t.me/CVEtracker/33723 · Telegram Post
• https://twitter.com/CVEnew/status/1973020390617210895 · Twitter Post
• https://t.me/cveNotify/137645 · Telegram Post