CVE-2025-34211
Published: 29 September 2025
Summary
CVE-2025-34211 is a critical-severity Use of Hard-coded Cryptographic Key (CWE-321) vulnerability in Vasion Virtual Appliance Application. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Private Keys (T1552.004); ranked at the 16.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-31640
Vulnerability details
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA and SaaS deployments) contain a private SSL key and matching public certificate stored in cleartext. The key belongs to the hostname `pl‑local.com`…
more
and is used by the appliance to terminate TLS connections on ports 80/443. Because the key is hardcoded, any attacker who can gain container-level access can simply read the files and obtain the private key. With the private key, the attacker can decrypt TLS traffic, perform man-in-the-middle attacks, or forge TLS certificates. This enables impersonation of the appliance’s web UI, interception of credentials, and unrestricted access to any services that trust the certificate. The same key is identical across all deployed appliances meaning a single theft compromises the confidentiality of every Vasion Print installation. This vulnerability has been identified by the vendor as: V-2024-025 — Hardcoded SSL Certificate & Private Keys.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Hardcoded private SSL key stored in cleartext enables theft of private keys (T1552.004), decryption/MITM attacks on TLS traffic (T1557), and forging TLS certificates for impersonation (T1649).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Supply chain protection includes scrutiny of cryptographic implementations, reducing hard-coded keys planted by untrusted vendors.
Functional and assurance requirements specified in acquisition can prohibit hard-coded cryptographic keys in delivered products.
Proper key establishment and management processes directly preclude embedding static cryptographic keys in source code or binaries.
Approved PKI issuance and trust stores replace ad-hoc or hard-coded keys with properly managed, signed certificates.
Assessments can uncover and prevent suppliers from shipping components that contain hard-coded cryptographic keys.