Vulnerability · Published Sep 29, 2025 · Assigned by VulnCheck

CVE-2025-34234Vasion Print (formerly PrinterLogic) Hardcoded Encryption Private Keys

Critical 9.2

In plain English

A critical-severity security flaw in Print Application from Vasion. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)9.2Critical

Exploit odds (30 days)0.4%top 64.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain two hardcoded private keys that are shipped in the application containers (printerlogic/pi, printerlogic/printer-admin-api, and printercloud/pi). The keys are stored in clear text under /var/www/app/config/ as keyfile.ppk.dev and keyfile.saasid.ppk.dev. The application uses these keys as the symmetric secret for AES‑256‑CBC encryption/decryption of the “SaaS Id” (external identifier) through the getEncryptedExternalId() / getDecryptedExternalId() methods. Because the secret is embedded in the deployed image, any attacker who can obtain a copy of the Docker image, read the configuration files, or otherwise enumerate the filesystem can recover the encryption key. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.

Affected products (as reported)

Vendor	Product	Versions
Vasion	Print Virtual Appliance Host	0 – before 25.1.102
Vasion	Print Application	0 – before 25.1.1413

Weakness: CWE-321 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

References

https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-hardcoded-key technical-description
https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm vendor-advisory, patch
https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm vendor-advisory, patch
https://www.vulncheck.com/advisories/vasion-print-printerlogic-hardcoded-encryption-private-keys third-party-advisory