CVE-2025-34196CWE-522CWE-798hardcoded-credentials

CVE-2025-34196

Critical · published September 29, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
40.3
In the wild
Unconfirmed
What it is

🚨 A hardcoded private key for the PrinterLogic Certificate Authority lurks in plain sight! This vulnerability is a game changer that could leave your network wide open to cyber villains. 🔥 Imagine leaving the master key to a secure vault in the front desk for anyone to grab! That's what it's like when sensitive configuration files contain hardcoded secrets, allowing attackers to impersonate the CA and decrypt sensitive communications. An attacker armed with these files could easily impersonate the Certificate Authority, signing untrustworthy certificates that would trick the Windows client into thinking it’s communicating securely. This could lead to devastating man-in-the-middle attacks, where attackers intercept or decrypt sensitive data, exposing your entire network to compromise.

Put simply

Imagine leaving the master key to a secure vault in the front desk for anyone to grab! That's what it's like when sensitive configuration files contain hardcoded secrets, allowing attackers to impersonate the CA and decrypt sensitive communications. This vulnerability in Vasion Print versions prior to 25.1.102 and 25.1.1413 allows attackers to exploit hardcoded private keys and passwords in configuration files, enabling them to sign arbitrary certificates and execute impersonation attacks on the product's network communications.

What to do

An attacker armed with these files could easily impersonate the Certificate Authority, signing untrustworthy certificates that would trick the Windows client into thinking it’s communicating securely. This could lead to devastating man-in-the-middle attacks, where attackers intercept or decrypt sensitive data, exposing your entire network to compromise. Update to Vasion Print version 25.1.102 or later and version 25.1.1413 or later for Windows client deployments immediately. Additionally, review configuration files and ensure sensitive data is secured properly to prevent unauthorized access. You've got this! With these updates, you’ll be a security hero, keeping your network safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00478 · 40.3th percentile
Weaknesses
CWE-522 · Insufficiently Protected Credentials; CWE-798 · Use of Hard-coded Credentials
Published
2025-09-29T23:15Z
Affected products (2)
ProductVersionsFixed in
vasion/virtual_appliance_application< 25.1.141325.1.1413
vasion/virtual_appliance_host< 25.1.10225.1.102
References (4)
EPSS history
Timeline
  • 29 SEP 19:11Z
    Vasion Print (formerly PrinterLogic) Hardcoded PrinterLogic CA Private Key and Hardcoded Password
    cvelistv5