CVE-2025-27640
Published: 05 March 2025
Description
Adversaries may leverage databases to mine valuable information.
Security Summary
CVE-2025-27640 is a SQL injection vulnerability (CWE-89) in Vasion Print, formerly known as PrinterLogic, affecting Virtual Appliance Host versions before 22.0.1002 and Application versions before 20.0.2614. Published on 2025-03-05, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.
An unauthenticated attacker with network access can exploit this vulnerability through low-complexity attacks requiring no user interaction. Exploitation enables high-impact consequences across confidentiality, integrity, and availability, such as executing arbitrary SQL queries to read sensitive data, modify database contents, or disrupt services.
The vendor's security bulletin at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm provides details on mitigation, with upgrading to Virtual Appliance Host 22.0.1002 Application 20.0.2614 or later resolving the SQL injection issue designated as V-2024-012.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection in a network-accessible application directly enables T1190 (Exploit Public-Facing Application) for unauthenticated remote exploitation; arbitrary SQL queries also facilitate T1213.006 (Data from Information Repositories: Databases) for reading/modifying DB contents.