CVE-2025-34209: virtual appliance application before 20.0.2014 (exclusive); +3 more affected products

Affected technology

virtual appliance application · before 20.0.2014 (exclusive)
vasion

virtual appliance host · before 22.0.862 (exclusive)
vasion

Print Virtual Appliance Host · 0 to before 22.0.862
Vasion

Print Application · 0 to before 20.0.2014
Vasion

Description’s affected range: prior to 22.0.862 and Application prior to 20.0.2014 (VA and SaaS deployments)

Component: Docker images – embedded GPG key pair, Firmware‑update signing workflow

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · High privileges required · No user interaction required

What an attacker can do

An attacker with administrative access to the appliance can extract the private key, import it into their own system, and subsequently decrypt GPG-encrypted files and sign arbitrary firmware update packages. Vendor/CNA’s CVSS 4.0 assessment (base score 9.4/10) rates confidentiality, integrity and availability impact as high.