CVE-2025-34210 Vasion Print (formerly PrinterLogic) Readable Cleartext Passwords

Critical 9.4 Published 2 Oct 2025 Updated 17 Nov 2025

Local users can read world-readable files containing cleartext credentials, leading to full appliance compromise unless storage encryption is configured.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-34210?

CVE-2025-34210 is a critical vulnerability in Vasion Print Application, published on 2 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store a large number of sensitive credentials (database passwords, MySQL root password, SaaS keys, Portainer admin password, etc.) in cleartext files that are world-readable. Any local user - or any process that can read the host filesystem - can retrieve all of these secrets in plain text, leading to credential theft and full compromise of the appliance. The vendor does not consider this to be a security vulnerability as this product "follows a shared responsibility model, where administrators are expected to configure persistent storage encryption."

Weakness: CWE-256

Which versions are affected by CVE-2025-34210?

It affects 2 products.

Products include Vasion Virtual Appliance Application, Vasion Virtual Appliance Host.

How do I fix CVE-2025-34210?

No fix has been published for CVE-2025-34210 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-34210 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34210 exists.

Sources

Also known as GHSA-2g9f-v599-7rv2.