The vulnerability CVE-2025-34198 affects Vasion Print Virtual Appliance Host and Application versions prior to 22.0.951 and 20.0.2368 respectively. The issue is the presence of hardcoded SSH host private keys embedded in the appliance image, which are identical across all installations. This allows an attacker who obtains these keys from one compromised appliance or image to impersonate any appliance using the same keys, decrypt SSH traffic, and conduct man-in-the-middle or impersonation attacks against administrative SSH sessions. The vulnerability is categorized under CWE-798 (Use of Hard-coded Credentials) and has a CVSS 4.0 score of 9.3, indicating critical severity. The vendor has assigned this issue the identifier V-2024-011 but no patch or fix details are provided in the available data.

The impact of this vulnerability is critical because it allows attackers to impersonate the appliance and decrypt or intercept SSH connections to any affected appliance using the same hardcoded keys. This compromises the confidentiality and integrity of administrative SSH sessions, potentially leading to unauthorized access and control over the appliance. Given the high CVSS score (9.3) and the nature of the vulnerability, exploitation could severely undermine the security of affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should monitor the vendor's security advisories for updates. Until a fix is available, consider restricting SSH access to trusted networks and using additional network-level protections to limit exposure. Avoid using affected versions and plan for upgrade once a vendor fix is released.