CVE-2025-27642
Published: 05 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-27642 is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) published on 2025-03-05, affecting Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions before 22.0.933 Application 20.0.2368. The issue, tracked as V-2024-008, enables unauthenticated driver package editing and is rooted in CWE-306 (Missing Authentication for Critical Function).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation allows high-impact compromise of confidentiality, integrity, and availability, potentially enabling attackers to modify driver packages in ways that lead to broader system control.
Advisories and further details on mitigation are available in PrinterLogic's security bulletins at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm, Pierre Kim's analysis of 83 Vasion/PrinterLogic vulnerabilities at https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html, and the Full Disclosure mailing list posting at http://seclists.org/fulldisclosure/2025/Apr/18.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability allows remote unauthenticated exploitation of a public-facing application (virtual appliance) to edit driver packages, directly mapping to T1190 for initial access and broader system control.