CVE-2025-34209

The GPG private key associated with the no-reply+virtual-appliance@printerlogic.com account is stored in plaintext within Docker images supplied with the application, and the key passphrase is hardcoded in system files. An attacker with administrative access to the device can extract the private key and import it into their own system. Subsequently, they can decrypt GPG-encrypted files and sign arbitrary firmware update packages so that the system recognizes them as authentic. A malicious signed update uploaded by the attacker will be executed by the appliance, granting the attacker full control over the device.

An attacker with administrative privileges can gain full control over the Virtual Appliance, including the ability to decrypt sensitive data and distribute malicious firmware updates. This results in complete device takeover and potential compromise of the printing environment integrity.

Update Virtual Appliance Host to version 22.0.862 or later and Virtual Appliance Application to version 20.0.2014 or later. Patches are available according to vendor security bulletins at the addresses indicated in the references. Until the update is applied, it is recommended to restrict administrative access to the appliance to trusted and strictly controlled accounts only.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host in versions prior to 22.0.862 and Virtual Appliance Application in versions prior to 20.0.2014 — affecting VA and SaaS deployments.