CVE-2025-34210

The vulnerability results from CWE-256 classified storage of passwords in unencrypted form (plaintext). Files containing credentials are marked with world-readable permissions, meaning any user or process running on the host can read them without any additional privileges. An attacker who gains minimal local access (e.g., through another vulnerability) can read a complete set of critical passwords with a single command — database credentials, MySQL root password, SaaS keys, and Portainer administrator account password. The manufacturer does not recognize this as a security vulnerability, citing the shared responsibility model and the expectation that administrators will configure storage encryption.

An attacker gains access to a complete set of critical credentials of the Virtual Appliance environment, which in practice means full compromise of the device — including access to the database, container infrastructure (Portainer), and integration keys with SaaS services.

The manufacturer has not released a patch, as they do not recognize the issue as a security vulnerability. Recommended compensatory actions: enable encryption of persistent storage in accordance with the manufacturer's documentation (shared responsibility model), restrict local access to the host exclusively to trusted administrative accounts, apply the principle of least privilege for processes running on the host, monitor unauthorized access to configuration files. You should monitor the manufacturer's security bulletins at the addresses indicated in the references.

Vasion Print (formerly PrinterLogic) Virtual Appliance Application and Virtual Appliance Host in VA/SaaS deployments; specific versions indicated in the manufacturer's references