CVE-2025-34211

The SSL private key assigned to the hostname `pl-local.com` is used by the device to terminate TLS connections on ports 80 and 443. The key is stored in files within the container in unencrypted cleartext. An attacker who gains container-level access can read the key files without any additional privileges. Since the identical key is embedded in every product deployment, obtaining it from one instance enables attacks on all remaining installations.

An attacker possessing the stolen key can decrypt intercepted TLS traffic, conduct man-in-the-middle attacks, impersonate the device's web interface, and intercept user credentials. It is also possible to forge TLS certificates and gain unrestricted access to services that trust this certificate.

Update Virtual Appliance Host to version 22.0.1049 or later and Virtual Appliance Application to version 20.0.2786 or later. Additional details are available in the vendor's security bulletins at the reference addresses. After applying patches, verify that new deployments no longer contain the shared key and consider inspecting network traffic for signs of potential previous MITM attacks.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host in versions prior to 22.0.1049 and Virtual Appliance Application in versions prior to 20.0.2786 — affects both VA and SaaS deployments.