CVE-2025-27638
Published: 05 March 2025
Summary
CVE-2025-27638 is a critical-severity Use of Hard-coded Password (CWE-259) vulnerability in Printerlogic Vasion Print. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 30.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-27638 is a hardcoded password vulnerability (CWE-259), designated as V-2024-013, affecting Vasion Print, formerly known as PrinterLogic. It impacts Virtual Appliance Host versions prior to 22.0.1002 and Application versions prior to 20.0.2614. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its potential for severe impact.
Remote, unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation grants high-level impacts on confidentiality, integrity, and availability, likely enabling unauthorized access via the hardcoded credentials.
Advisories recommend upgrading to Virtual Appliance Host 22.0.1002 or later and Application 20.0.2614 or later to mitigate the issue. Further details on patches and remediation are provided in the PrinterLogic security bulletin at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm, Pierre Kim's disclosure of 83 Vasion/PrinterLogic vulnerabilities at https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html, and the Full Disclosure mailing list entry at http://seclists.org/fulldisclosure/2025/Apr/18.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6080
Vulnerability details
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Hardcoded Password V-2024-013.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Hardcoded password vulnerability directly enables use of known valid credentials for remote unauthorized access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely patching and upgrading of vulnerable software components to remediate the hardcoded password flaw as specified in vendor advisories.
Mandates management of authenticators including changing defaults and prohibiting weak or hardcoded passwords to block unauthorized access.
Enables vulnerability scanning to identify the presence of CVE-2025-27638 in deployed systems for proactive remediation.