Cyber Posture

CVE-2025-27673

Critical

Published: 05 March 2025

Published
05 March 2025
Modified
01 April 2025
KEV Added
Patch
CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0034 56.4th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

Security Summary

CVE-2025-27673 is a high-severity vulnerability (CVSS 9.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) affecting Vasion Print, formerly known as PrinterLogic, specifically versions of the Virtual Appliance Host before 22.0.843 Application 20.0.1923. The issue, tracked as OVE-20230524-0017 and mapped to CWE-539, involves cookies being returned in the response body, which can lead to information exposure.

Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation enables high-impact confidentiality and integrity violations, such as potential session hijacking or unauthorized access to sensitive data through exposed cookies.

Mitigation details and security bulletins are available from the vendor at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm. The CVE was published on 2025-03-05T06:15:40.167.

Details

CWE(s)
CWE-539

Affected Products

printerlogic
vasion print
≤ 20.0.1923
printerlogic
virtual appliance
≤ 22.0.843

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
Why these techniques?

Vulnerability in public-facing web application exposes session cookies in response body, directly enabling remote exploitation (T1190) and theft of web session cookies for hijacking (T1539).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References