CVE-2025-27659
Published: 05 March 2025
Summary
CVE-2025-27659 is a critical-severity SQL Injection (CWE-89) vulnerability in Printerlogic Vasion Print. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-27659 is a SQL injection vulnerability (CWE-89), tracked as OVE-20230524-0002, affecting Vasion Print, formerly known as PrinterLogic. The issue impacts Virtual Appliance Host versions before 22.0.843 with Application versions before 20.0.1923. Published on 2025-03-05, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for severe impacts across confidentiality, integrity, and availability.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows high-impact outcomes, including unauthorized access to sensitive data, modification of database contents, and disruption of system availability, potentially leading to full compromise of the affected appliance.
Mitigation details are available in the vendor's security bulletin at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm, which corresponds to the vulnerable versions specified. Security practitioners should upgrade to Virtual Appliance Host 22.0.843 Application 20.0.1923 or later to address the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6059
Vulnerability details
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows SQL Injection OVE-20230524-0002.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The remote unauthenticated SQL injection in the public-facing Vasion Print web application directly enables exploitation of a public-facing service, mapping to T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation of all information inputs to block malicious SQL payloads from execution.
Addresses the specific SQL injection flaw in the Vasion Print appliance by mandating timely remediation through vendor patching to version 22.0.843 or later.
Mitigates SQL injection by enforcing restrictions on input types, sources, and quantities at system boundaries to limit attack surface.