Cyber Resilience

CVE-2025-34211

Exposed Creds in Vasion Virtual Appliance Application ≤ 20.0.2786

Public PoCExposed Creds
Published
29 September 2025
Modified
03 October 2025
Patch / advisory
CVSS Score v4 9.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0037 30th percentile
Risk Priority 31 floored blend · peak EPSS

Summary

CVE-2025-34211 is a critical-severity Use of Hard-coded Cryptographic Key (CWE-321) vulnerability in Vasion Virtual Appliance Application. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Private Keys (T1552.004); ranked at the 30th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA and SaaS deployments) contain a private SSL key and matching public certificate stored in cleartext. The key belongs to the hostname `pl‑local.com`…

more

and is used by the appliance to terminate TLS connections on ports 80/443. Because the key is hardcoded, any attacker who can gain container-level access can simply read the files and obtain the private key. With the private key, the attacker can decrypt TLS traffic, perform man-in-the-middle attacks, or forge TLS certificates. This enables impersonation of the appliance’s web UI, interception of credentials, and unrestricted access to any services that trust the certificate. The same key is identical across all deployed appliances meaning a single theft compromises the confidentiality of every Vasion Print installation. This vulnerability has been identified by the vendor as: V-2024-025 — Hardcoded SSL Certificate & Private Keys.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1552.004 Private Keys Credential Access
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials.
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-34234Same product: Vasion Virtual Appliance Application
CVE-2025-34217Same product: Vasion Virtual Appliance Application
CVE-2025-34215Same product: Vasion Virtual Appliance Application
CVE-2025-34210Same product: Vasion Virtual Appliance Application
CVE-2025-34198Same product: Vasion Virtual Appliance Application
CVE-2025-34209Same product: Vasion Virtual Appliance Application
CVE-2025-34197Same product: Vasion Virtual Appliance Application
CVE-2025-34200Same product: Vasion Virtual Appliance Application
CVE-2025-34223Same product: Vasion Virtual Appliance Application
CVE-2025-34216Same product: Vasion Virtual Appliance Application

Affected Assets

vasion
virtual appliance application
≤ 20.0.2786
vasion
virtual appliance host
≤ 22.0.1049

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Requiring cryptographic keys to be established and managed according to defined requirements prevents developers from embedding static unchangeable keys.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure-SDLC activities such as code review and secret scanning directly prevent embedding static keys.

PR.DS-01 partial match
prevents

Data-at-rest protection policies require proper key management and therefore discourage hard-coded keys.

PR.DS-02 partial match
prevents

Data-in-transit protection similarly depends on non-hard-coded keys for encryption.

PR.PS-01 partial match
prevents

Configuration baselines and reviews can prohibit hard-coded keys in deployed artifacts.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Key-management controls that govern generation, rotation and protection of keys make the use of embedded hard-coded cryptographic keys less likely and easier to detect.

References