CVE-2025-27656
Printerlogic Vasion Print ≤ 20.0.2014
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-27656 is a critical-severity Plaintext Storage of a Password (CWE-256) vulnerability in Printerlogic Vasion Print. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked in the top 45% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-28 (Protection of Information at Rest) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-27656 is a critical vulnerability in Vasion Print, formerly known as PrinterLogic, specifically affecting versions before Virtual Appliance Host 22.0.862 Application 20.0.2014. The issue involves passwords stored in plain text in the process list, classified under CWE-256 (Plain-text Storage of a Password). It received a CVSS v3.1 base score of 9.8, reflecting its high severity due to network accessibility, low attack complexity, no required privileges or user interaction, and significant impacts on confidentiality, integrity, and availability.
Remote attackers without authentication can exploit this vulnerability by accessing the process list, potentially extracting sensitive passwords. Successful exploitation enables high-level compromise, including unauthorized access to credentials that could lead to further system takeover, data exfiltration, or disruption of print management services.
Mitigation requires upgrading to Virtual Appliance Host 22.0.862 Application 20.0.2014 or later. Vendor security bulletins and advisories provide additional details, available at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm, along with disclosure analyses such as Pierre Kim's report on 83 related vulnerabilities at https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html and a Full Disclosure mailing list entry at http://seclists.org/fulldisclosure/2025/Apr/18.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6062
Vulnerability Data
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Password Stored in Process List V-2023-011.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requiring confidentiality protection of information at rest directly stops passwords from being stored in plaintext.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Encryption and hashing of data-at-rest directly prevent plaintext password storage in files.
Credential management practices normally include secure storage requirements for passwords.
Protecting data-in-use can limit exposure of passwords held in memory.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Directly requires secure handling and protection of authentication information, preventing plaintext password storage.
Requires use of cryptography to protect sensitive data such as passwords at rest.
Secure coding practices would prevent developers from writing code that stores passwords in plaintext.
Mandates secure authentication mechanisms that inherently require hashed or encrypted credentials rather than plaintext.
Requires secure deletion of sensitive information, indirectly reducing exposure of stored plaintext passwords.