Cyber Posture

CVE-2025-27682

Critical

Published: 05 March 2025

Published
05 March 2025
Modified
03 November 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0021 43.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Security Summary

CVE-2025-27682 is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) involving insecure log permissions (CWE-276, designated V-2022-005) in Vasion Print, formerly known as PrinterLogic. It affects the Virtual Appliance Host before version 1.0.735 Application 20.0.1330.

The vulnerability enables exploitation by remote, unauthenticated attackers requiring low complexity and no user interaction. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially allowing full system compromise.

Advisories recommend upgrading to Virtual Appliance Host 1.0.735 Application 20.0.1330 or later for mitigation. Relevant details are provided in PrinterLogic's security bulletins at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm, Pierre Kim's analysis of 83 Vasion/PrinterLogic vulnerabilities at https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html, and a Full Disclosure mailing list post at http://seclists.org/fulldisclosure/2025/Apr/18.

This vulnerability was published on 2025-03-05 and is part of a larger set of 83 flaws highlighted in independent research.

Details

CWE(s)
CWE-276

Affected Products

printerlogic
vasion print
≤ 20.0.1330
printerlogic
virtual appliance
≤ 1.0.735

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Why these techniques?

The CVE describes a remote unauthenticated vulnerability (AV:N/PR:N) in a public-facing virtual appliance with insecure log permissions, directly enabling exploitation of public-facing applications (T1190) and unauthorized access to local system data via exposed logs (T1005), leading to high-impact compromise.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

References