Executive Summary

This vulnerability involves Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application versions containing shared, hardcoded SSH host private keys embedded in the appliance image. These private keys (RSA, ECDSA, and ED25519) are identical across different installations instead of being uniquely generated per appliance. An attacker who obtains these keys can impersonate the appliance, decrypt or intercept SSH connections, and perform man-in-the-middle or impersonation attacks against administrative SSH sessions without needing privileges or user interaction. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow an attacker to remotely gain unauthorized access to affected systems by impersonating the appliance or intercepting SSH connections. This can lead to compromise of confidentiality and integrity of administrative SSH sessions, enabling man-in-the-middle attacks or unauthorized control over the appliance. The attack requires no privileges or user interaction and has a high impact on confidentiality and integrity. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Vasion Print Virtual Appliance Host to version 22.0.951 or later and the Print Application to version 20.0.2368 or later, as these versions address the issue by removing the shared hardcoded SSH host private keys. Additionally, replacing the SSH host keys with unique keys per appliance and reviewing SSH access logs for suspicious activity are recommended. [1]

Useful 0 Not Useful 0