CVE-2025-34198
📋 TL;DR
Vasion Print (formerly PrinterLogic) appliances use the same hardcoded SSH host private keys across all installations instead of unique per-appliance keys. This allows attackers who obtain these keys to impersonate appliances, intercept SSH connections, and perform man-in-the-middle attacks against administrative sessions. All deployments using affected versions are vulnerable.
💻 Affected Systems
- Vasion Print Virtual Appliance Host
- Vasion Print Application
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of administrative SSH sessions, allowing attackers to gain full control over appliances, intercept sensitive data, and pivot to internal networks.
Likely Case
Attackers intercept administrative SSH sessions, capture credentials, and gain unauthorized access to appliance management interfaces.
If Mitigated
Limited impact if SSH access is restricted to trusted networks and monitored for unusual connections.
🎯 Exploit Status
Exploitation requires obtaining the hardcoded private keys (available from compromised images) and network access to SSH services. No authentication needed once keys are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Virtual Appliance Host 22.0.951+, Application 20.0.2368+
Vendor Advisory: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
Restart Required: Yes
Instructions:
1. Update to patched versions via vendor update mechanism. 2. Regenerate SSH host keys on all appliances. 3. Restart SSH service or reboot appliances.
🔧 Temporary Workarounds
Regenerate SSH host keys manually
linuxGenerate unique SSH host keys for each appliance to replace hardcoded keys
ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -N ""
ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key -N ""
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""
systemctl restart sshd
Restrict SSH access
linuxLimit SSH connections to trusted IP addresses using firewall rules
iptables -A INPUT -p tcp --dport 22 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
🧯 If You Can't Patch
- Isolate appliances in separate network segments with strict access controls
- Implement SSH certificate-based authentication instead of key-based
🔍 How to Verify
Check if Vulnerable:
Check SSH host key fingerprints against known hardcoded values or compare fingerprints across multiple appliancesCheck Version:
Check appliance version in web interface or via vendor-specific commandsVerify Fix Applied:
Verify SSH host keys are unique per appliance and different from known hardcoded keys📡 Detection & Monitoring
Log Indicators:
- Multiple SSH connections from same source to different appliances
- SSH key warnings in logs
- Unexpected SSH host key changes
Network Indicators:
- SSH traffic to appliances from unexpected sources
- MITM patterns in SSH handshakes
SIEM Query:
source="ssh" AND (event="Failed publickey" OR event="Connection closed") | stats count by src_ip dest_ip🔗 References
- https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
- https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm
- https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-hardcoded-ssh-keys
- https://www.vulncheck.com/advisories/vasion-print-printerlogic-shared-hardcoded-ssh-host-private-keys-in-appliance-image
