CVE-2025-34217

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-34217
Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) contain an undocumented 'printerlogic' user with a hardcoded SSH public key in '~/.ssh/authorized_keys' and a sudoers rule granting the printerlogic_ssh group 'NOPASSWD: ALL'. Possession of the matching private key gives an attacker root access to the appliance.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm Vendor Advisory
https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm Vendor Advisory
https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-undocumented-hardcoded-ssh-key Exploit Third Party Advisory
https://www.vulncheck.com/advisories/vasion-print-printerlogic-incorrect-encryption-algorithms-used-to-store-passwords Broken Link
https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-undocumented-hardcoded-ssh-key Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:vasion:virtual_appliance_application:-:*:*:*:*:*:*:*
cpe:2.3:a:vasion:virtual_appliance_host:-:*:*:*:*:*:*:*
History

17 Jun 2026, 09:13

Type Values Removed Values Added
Summary
  • (es) Vasion Print (anteriormente PrinterLogic) Host y Aplicación de Dispositivo Virtual (despliegues VA/SaaS) contienen un usuario 'printerlogic' no documentado con una clave pública SSH codificada en '~/.ssh/authorized_keys' y una regla de sudoers que otorga al grupo printerlogic_ssh 'NOPASSWD: ALL'. La posesión de la clave privada correspondiente le da a un atacante acceso de root al dispositivo.

07 Oct 2025, 14:02

Type Values Removed Values Added
First Time Vasion
Vasion virtual Appliance Application
Vasion virtual Appliance Host
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CPE cpe:2.3:a:vasion:virtual_appliance_application:-:*:*:*:*:*:*:*
cpe:2.3:a:vasion:virtual_appliance_host:-:*:*:*:*:*:*:*
References () https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm - () https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm - Vendor Advisory
References () https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm - () https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm - Vendor Advisory
References () https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-undocumented-hardcoded-ssh-key - () https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-undocumented-hardcoded-ssh-key - Exploit, Third Party Advisory
References () https://www.vulncheck.com/advisories/vasion-print-printerlogic-incorrect-encryption-algorithms-used-to-store-passwords - () https://www.vulncheck.com/advisories/vasion-print-printerlogic-incorrect-encryption-algorithms-used-to-store-passwords - Broken Link

30 Sep 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-09-30 14:15

Updated : 2026-06-17 09:13

NVD link : CVE-2025-34217

Mitre link : CVE-2025-34217

CVE.ORG link : CVE-2025-34217

JSON object : View

Products Affected

vasion

  • virtual_appliance_application
  • virtual_appliance_host
CWE
CWE-321

Use of Hard-coded Cryptographic Key