CVE-2025-27672
Published: 05 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-27672 is an OAuth security bypass vulnerability (tracked internally as OVE-20230524-0016) affecting Vasion Print, formerly known as PrinterLogic, specifically versions of the Virtual Appliance Host prior to 22.0.843 and the Application prior to 20.0.1923. Assigned a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), it stems from CWE-287 (Improper Authentication), enabling attackers to circumvent authentication mechanisms in the OAuth flow.
Remote attackers require no privileges or user interaction and can exploit this over the network with low complexity. Successful exploitation grants high-impact access, compromising confidentiality, integrity, and availability, potentially allowing full control over the affected virtual appliance.
The vendor's security bulletin at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm details mitigation steps, including upgrading to Virtual Appliance Host 22.0.843 or later and Application 20.0.1923 or later.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CVE describes an authentication bypass (CWE-287) in a public-facing Vasion Print virtual appliance, allowing remote unauthenticated attackers to gain full control over the system. This directly maps to exploitation of a public-facing application.