CVE-2025-27662
Published: 05 March 2025
Summary
CVE-2025-27662 is a critical-severity Plaintext Storage of a Password (CWE-256) vulnerability in Printerlogic Vasion Print. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and IA-5 (Authenticator Management).
Deeper analysis
CVE-2025-27662 affects Vasion Print, formerly known as PrinterLogic, in versions prior to Virtual Appliance Host 22.0.843 Application 20.0.1923. The vulnerability involves insecure password handling in URLs, tracked as OVE-20230524-0005 and mapped to CWE-256 (Plaintext Storage of a Password). It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for severe impacts across confidentiality, integrity, and availability.
Attackers with network access can exploit this vulnerability remotely without authentication, privileges, or user interaction. Exploitation enables high-impact compromise, allowing unauthorized access to sensitive credentials and potentially full control over the virtual appliance, including data exfiltration, modification, or disruption of print management services.
Mitigation guidance is available in PrinterLogic's security bulletins at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm, which detail patching to Virtual Appliance Host 22.0.843 Application 20.0.1923 or later to address the password-in-URL exposure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6056
Vulnerability details
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Password in URL OVE-20230524-0005.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote unauthenticated vulnerability in a public-facing print management application allowing direct access to credentials via insecure password handling in URLs (CWE-256), directly mapping to exploitation of public-facing apps (T1190) and discovery of unsecured credentials (T1552).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires protecting authenticator content from unauthorized disclosure and modification, directly mitigating the plaintext exposure of passwords in URLs.
Mandates timely identification, reporting, and correction of system flaws like this password-in-URL vulnerability through patching to the fixed version.
Establishes and enforces secure configuration settings to prohibit insecure practices such as embedding passwords in URLs within the virtual appliance.