CVE-2025-34209: Vasion Print (formerly PrinterLogic) Hardcoded GPG Private Key
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.862 and Application prior to 20.0.2014 (VA and SaaS deployments) contain Docker images with the private GPG key and passphrase for the account no‑reply+virtual‑appliance@printerlogic.com. The key is stored in cleartext and the passphrase is hardcoded in files. An attacker with administrative access to the appliance can extract the private key, import it into their own system, and subsequently decrypt GPG-encrypted files and sign arbitrary firmware update packages. A maliciously signed update can be uploaded by an admin‑level attacker and will be executed by the appliance, giving the attacker full control of the virtual appliance. This vulnerability has been identified by the vendor as: V-2023-010 — Hardcoded Private Key.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34209?
CVE-2025-34209 is considered a high-severity vulnerability due to the exposure of sensitive private GPG keys.
How do I fix CVE-2025-34209?
To fix CVE-2025-34209, upgrade Vasion Print to version 22.0.862 or later, and version 20.0.2014 or later for the application.
What is affected by CVE-2025-34209?
CVE-2025-34209 affects Vasion Print Virtual Appliance Host versions prior to 22.0.862 and Vasion Print Application versions prior to 20.0.2014.
What are the implications of CVE-2025-34209?
The implications of CVE-2025-34209 include potential unauthorized access to the GPG keys, leading to compromised security of the application.
Is CVE-2025-34209 a common vulnerability?
CVE-2025-34209 can be considered a serious issue due to its potential widespread impact on systems using affected versions of Vasion Print.