The vulnerability CVE-2025-34211 (CWE-321) affects Vasion Print Virtual Appliance Host versions prior to 22.0.1049 and Application versions prior to 20.0.2786. A private SSL key and public certificate for hostname 'pl-local.com' are hardcoded and stored in cleartext within the appliance. Because the key is identical across all deployments, compromise of one appliance exposes all others. An attacker with container-level privileges can read the private key, allowing decryption of TLS traffic, man-in-the-middle attacks, and forging of TLS certificates to impersonate the appliance’s web interface or intercept credentials. This vulnerability is tracked as V-2024-025 by the vendor.

The impact is critical as the hardcoded private key enables attackers with container access to decrypt TLS communications, perform man-in-the-middle attacks, and impersonate the appliance’s web UI. This leads to interception of sensitive credentials and unrestricted access to services trusting the certificate. Since the key is identical across all installations, a single compromise affects the confidentiality and integrity of every Vasion Print deployment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided in the available data. Until a fix is available, restrict container-level access to trusted users only and monitor for unauthorized access. Follow vendor advisories closely for updates on remediation.