Vasion Print Weak Password Encryption Vulnerability

A vulnerability exists in Vasion Print (formerly PrinterLogic) versions prior to Virtual Appliance Host 22.0.843 Application 20.0.1923, allowing weak password encryption. The application stored passwords using unsalted SHA1 hashing and transmitted authentication data with a custom double base64 encoding. While SHA1 is no longer actively used, the application retained this hashing method for backward compatibility with legacy passwords. The double-encoded credentials were intended to be non-reversible and were primarily protected by the HTTPS protocol.

Impact

Exploitation of this vulnerability could lead to the exposure of passwords, allowing for unauthorized access to user accounts.

Remediation

Users can update to Vasion Print, Virtual Appliance Host 22.0.843 / Application 20.0.1923 to address this vulnerability.