CVE-2025-27662
Printerlogic Vasion Print ≤ 20.0.1923
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-27662 is a critical-severity Plaintext Storage of a Password (CWE-256) vulnerability in Printerlogic Vasion Print. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-28 (Protection of Information at Rest) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-27662 affects Vasion Print, formerly known as PrinterLogic, in versions prior to Virtual Appliance Host 22.0.843 Application 20.0.1923. The vulnerability involves insecure password handling in URLs, tracked as OVE-20230524-0005 and mapped to CWE-256 (Plaintext Storage of a Password). It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for severe impacts across confidentiality, integrity, and availability.
Attackers with network access can exploit this vulnerability remotely without authentication, privileges, or user interaction. Exploitation enables high-impact compromise, allowing unauthorized access to sensitive credentials and potentially full control over the virtual appliance, including data exfiltration, modification, or disruption of print management services.
Mitigation guidance is available in PrinterLogic's security bulletins at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm, which detail patching to Virtual Appliance Host 22.0.843 Application 20.0.1923 or later to address the password-in-URL exposure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6056
Vulnerability Data
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Password in URL OVE-20230524-0005.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requiring confidentiality protection of information at rest directly stops passwords from being stored in plaintext.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Encryption and hashing of data-at-rest directly prevent plaintext password storage in files.
Credential management practices normally include secure storage requirements for passwords.
Protecting data-in-use can limit exposure of passwords held in memory.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Directly requires secure handling and protection of authentication information, preventing plaintext password storage.
Requires use of cryptography to protect sensitive data such as passwords at rest.
Secure coding practices would prevent developers from writing code that stores passwords in plaintext.
Mandates secure authentication mechanisms that inherently require hashed or encrypted credentials rather than plaintext.
Requires secure deletion of sensitive information, indirectly reducing exposure of stored plaintext passwords.