Vasion Print Virtual Appliance Host and Application versions prior to 25.1.102 and 25.1.1413 contain two hardcoded AES-256-CBC encryption keys stored in clear text files within application containers. These keys are used to encrypt and decrypt the SaaS Id external identifier. Because the keys are embedded in the deployed Docker images and accessible via the filesystem, an attacker who obtains the images or can enumerate the filesystem can extract the keys and decrypt sensitive identifiers. This represents a CWE-321 weakness (Use of Hard-coded Cryptographic Key). The vulnerability has been confirmed fixed, but the specific patch version or date is not provided.

The presence of hardcoded cryptographic keys allows attackers who gain access to the Docker images or filesystem to recover the AES-256-CBC encryption keys. This compromises the confidentiality of the encrypted SaaS Id external identifiers, potentially enabling unauthorized access or impersonation within the affected Vasion Print environment. The vulnerability has a critical CVSS score of 9.2, reflecting the high impact of key exposure without requiring privileges or user interaction. No known exploits in the wild have been reported.

This vulnerability has been confirmed as remediated by the vendor, although the exact patch version or date is not specified. Users should upgrade to Vasion Print Virtual Appliance Host version 25.1.102 or later and Application version 25.1.1413 or later to ensure the hardcoded keys are removed. Until upgraded, restrict access to Docker images and filesystem contents to trusted personnel only. Monitor vendor advisories for any additional guidance or updates.