Vasion Print Virtual Appliance Host and its Windows client versions before specified releases contain hardcoded private keys and passwords in shipped configuration files. These include the private key for the PrinterLogic CA and other sensitive credentials. This allows an attacker with access to these files to impersonate the CA, create trusted certificates, and intercept or decrypt TLS-protected communications, enabling man-in-the-middle or impersonation attacks. The vulnerability is tracked as V-2022-001 by the vendor and identified as CWE-798 (Use of Hard-coded Credentials) and CWE-522 (Insufficiently Protected Credentials). It has a CVSS 4.0 score of 9.3, indicating critical severity.

The vulnerability allows attackers who obtain the hardcoded private key and passwords to impersonate the trusted Certificate Authority used by the product. This enables signing of arbitrary certificates trusted by the Windows client, leading to interception or decryption of TLS communications. Consequently, attackers can perform man-in-the-middle attacks or impersonate legitimate services within the product's network communications, severely compromising confidentiality and trust.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to configuration files containing sensitive credentials to trusted administrators only and consider isolating affected systems to limit exposure.