CVE-2025-27684
Published: 05 March 2025
Description
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
Security Summary
CVE-2025-27684 is a vulnerability in Vasion Print, formerly known as PrinterLogic, affecting Virtual Appliance Host versions before 1.0.735 with Application versions before 20.0.1330. It involves the debug bundle containing sensitive data, mapped to CWE-215 (cleartext storage of sensitive information). The issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity due to network-accessible confidentiality impact.
Remote attackers require no privileges, authentication, or user interaction and face low attack complexity to exploit this flaw. Successful exploitation enables disclosure of sensitive data within the debug bundle, potentially compromising configuration details, credentials, or other proprietary information hosted on the appliance.
Advisories recommend upgrading to Virtual Appliance Host 1.0.735 Application 20.0.1330 or later to mitigate the issue. Additional details on patches and remediation are available in PrinterLogic's security bulletins at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm, Pierre Kim's disclosure of 83 related vulnerabilities at https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html, and the Full Disclosure mailing list post at http://seclists.org/fulldisclosure/2025/Apr/18.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Vulnerability enables remote unauthenticated access to a debug bundle with cleartext sensitive data including credentials, directly facilitating T1552.001 by providing unsecured credentials in files.