CVE-2025-34217 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host … | CVSS 10.0 CRITICAL

Description

Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) contain an undocumented 'printerlogic' user with a hardcoded SSH public key in '~/.ssh/authorized_keys' and a sudoers rule granting the printerlogic_ssh group 'NOPASSWD: ALL'. Possession of the matching private key gives an attacker root access to the appliance.

Metadata

CVE ID: CVE-2025-34217
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2025-04-15 19:15 UTC
Published: 2025-09-30 13:03 UTC
Last updated: 2025-11-17 23:56 UTC
Primary CWE: CWE-321
CWE-321 Use of Hard-coded Cryptographic Key
Vendor / Product: Vasion / Print Virtual Appliance Host
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (2)

Vendor	Product	Platform	Versions
Vasion	Print Application	—	*
Vasion	Print Virtual Appliance Host	—	*

Weakness (CWE)

CWE	Source	Description
CWE-321	cna	CWE-321 Use of Hard-coded Cryptographic Key

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References (4)