CVE-2025-34207: Vasion Print (formerly PrinterLogic) Insecure SSH Client Configuration
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 (VA and SaaS deployments) configure the SSH client within Docker instances with the following options: UserKnownHostsFile=/dev/null, StrictHostKeyChecking=no, and ForwardAgent yes. These settings disable verification of the remote host’s SSH key and automatically forward the developer’s SSH‑agent to any host that matches the configured wildcard patterns. As a result, an attacker who can reach a single compromised container can cause the container to connect to a malicious SSH server, capture the forwarded private keys, and use those keys for unrestricted lateral movement across the environment. This vulnerability has been identified by the vendor as: V-2024-027 — Insecure Secure Shell (SSH) Configuration.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34207?
CVE-2025-34207 is rated as a serious vulnerability due to its misconfiguration of SSH settings in Vasion Print software.
How can I mitigate the effects of CVE-2025-34207?
To mitigate CVE-2025-34207, users should update Vasion Print to version 22.0.1049 or later, and 20.0.2786 or later for the application.
What systems are affected by CVE-2025-34207?
CVE-2025-34207 affects Vasion Print Virtual Appliance Host prior to version 22.0.1049 and the Application prior to version 20.0.2786.
Is there a known exploit for CVE-2025-34207?
As of now, there are no publicly known exploits specifically targeting CVE-2025-34207.
What should I do if I can't update to the latest version to resolve CVE-2025-34207?
If updating is not possible, consider disabling SSH access to Docker instances as a temporary workaround for CVE-2025-34207.