Vasion Print Hardcoded SSH Key Vulnerability Granting Root Access

A critical vulnerability exists in Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application within VA/SaaS deployments. It involves an undocumented 'printerlogic' user with a hardcoded SSH public key in the authorized_keys file, allowing access via the corresponding private key. Additionally, a sudoers rule permits the 'printerlogic_ssh' group to execute any command without a password. This vulnerability effectively grants root access to the appliance.

Impact

Exploitation of this vulnerability provides root access to the Vasion Print Virtual Appliance.

Remediation

Users can update to Vasion Print, Virtual Appliance Host v22.0.1049 / Application v20.0.2786, where this vulnerability has been fixed.