CVE-2025-27647
Published: 05 March 2025
Summary
CVE-2025-27647 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Printerlogic Vasion Print. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-2 (Account Management).
Deeper analysis
CVE-2025-27647 is a critical authentication bypass vulnerability (CWE-306: Missing Authentication for Critical Function) in Vasion Print, formerly known as PrinterLogic, affecting versions prior to Virtual Appliance Host 22.0.913 Application 20.0.2253. The flaw allows unauthenticated attackers to add partial admin users without proper authentication checks, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It was published on 2025-03-05.
Remote attackers require no privileges or user interaction to exploit this over the network with low complexity. Successful exploitation enables the creation of partial admin accounts, potentially granting high-impact unauthorized access to confidentiality, integrity, and availability of the affected appliance, leading to full system compromise.
Vendor security bulletins and advisories, including those at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm, detail mitigation through upgrading to Virtual Appliance Host 22.0.913 Application 20.0.2253 or later. Additional analysis is available in Pierre Kim's disclosure at https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html and Full Disclosure mailing list at http://seclists.org/fulldisclosure/2025/Apr/18.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6071
Vulnerability details
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Addition of Partial Admin Users Without Authentication V-2024-002.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authentication bypass in public-facing Vasion Print appliance directly enables remote exploitation of the application (T1190) to create unauthorized local admin accounts (T1136.001) without credentials.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prohibits critical functions like adding partial admin users without identification or authentication, addressing the core CWE-306 vulnerability.
Requires management of account creation and modification processes to ensure only authorized entities can add admin users, preventing unauthorized account provisioning.
Mandates enforcement of access control policies at the system level to block unauthenticated access to admin user addition functions.