CVE-2025-34207
📋 TL;DR
This vulnerability allows attackers to capture SSH private keys from compromised Docker containers in Vasion Print deployments due to insecure SSH client configuration. The insecure settings disable host key verification and enable agent forwarding, enabling lateral movement across the environment. Affected systems include Vasion Print Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786.
💻 Affected Systems
- Vasion Print (formerly PrinterLogic) Virtual Appliance Host
- Vasion Print Application
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the entire environment through lateral movement using captured SSH keys, potentially leading to data exfiltration, ransomware deployment, or complete system takeover.
Likely Case
Lateral movement from a compromised container to other systems in the network, allowing privilege escalation and further exploitation.
If Mitigated
Contained compromise limited to the initial container with no ability to move laterally or access other systems.
🎯 Exploit Status
Exploitation requires initial access to a container. Public technical details and proof-of-concept information available in referenced advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Virtual Appliance Host 22.0.1049+, Application 20.0.2786+
Vendor Advisory: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
Restart Required: Yes
Instructions:
1. Update to Virtual Appliance Host version 22.0.1049 or later. 2. Update to Application version 20.0.2786 or later. 3. Restart affected services/containers. 4. Verify SSH client configuration no longer contains insecure settings.
🔧 Temporary Workarounds
Modify SSH client configuration
linuxRemove insecure SSH options from Docker container SSH client configuration files
sed -i 's/UserKnownHostsFile=\/dev\/null//g' /etc/ssh/ssh_config
sed -i 's/StrictHostKeyChecking=no//g' /etc/ssh/ssh_config
sed -i 's/ForwardAgent yes//g' /etc/ssh/ssh_config
🧯 If You Can't Patch
- Implement network segmentation to isolate Docker containers and restrict SSH connections
- Deploy host-based intrusion detection and monitor for unusual SSH connections or key usage
🔍 How to Verify
Check if Vulnerable:
Check SSH client configuration in Docker containers for the insecure options: grep -E 'UserKnownHostsFile=/dev/null|StrictHostKeyChecking=no|ForwardAgent yes' /etc/ssh/ssh_configCheck Version:
Check product version in administration interface or run appropriate version command for the deployment typeVerify Fix Applied:
Verify the insecure SSH options are removed from configuration and check version meets patched requirements📡 Detection & Monitoring
Log Indicators:
- Unusual SSH connections from containers
- SSH agent forwarding events
- Failed SSH host key verification attempts
Network Indicators:
- SSH connections from containers to unexpected internal hosts
- Multiple SSH sessions originating from single container
SIEM Query:
source="ssh" AND ("UserKnownHostsFile=/dev/null" OR "StrictHostKeyChecking=no" OR "ForwardAgent yes")🔗 References
- https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
- https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm
- https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-insecure-ssh-config
- https://www.vulncheck.com/advisories/vasion-print-printerlogic-insecure-ssh-client-config
- https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-insecure-ssh-config
