Cyber Posture

CVE-2025-27652

Critical

Published: 05 March 2025

Published
05 March 2025
Modified
03 November 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0013 31.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-27652 is a Server-Side Request Forgery (SSRF) vulnerability, designated as rfIDEAS V-2023-015 and mapped to CWE-918, affecting Vasion Print (formerly PrinterLogic) in versions prior to Virtual Appliance Host 22.0.862 Application 20.0.2014. Published on 2025-03-05, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and high impacts across confidentiality, integrity, and availability.

Remote unauthenticated attackers can exploit this SSRF flaw over the network with minimal effort. Exploitation enables severe consequences, including high-level compromise of confidentiality through unauthorized data access, integrity violations via data manipulation, and availability disruptions, all without privileges or user involvement.

Vendor advisories recommend upgrading to Virtual Appliance Host 22.0.862 Application 20.0.2014 or later for mitigation. Further details appear in PrinterLogic's security bulletins at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm, Pierre Kim's analysis of 83 related vulnerabilities at https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html, and the Full Disclosure mailing list post at http://seclists.org/fulldisclosure/2025/Apr/18.

Details

CWE(s)
CWE-918

Affected Products

printerlogic
vasion print
≤ 20.0.2014
printerlogic
virtual appliance
≤ 22.0.862

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The SSRF vulnerability in a publicly accessible application allows remote unauthenticated exploitation, directly mapping to T1190 for initial access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References