CVE-2025-27664
Published: 05 March 2025
Summary
CVE-2025-27664 is a high-severity CSRF (CWE-352) vulnerability in Printerlogic Vasion Print. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 35.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-27664 is an insufficient Cross-Site Request Forgery (CSRF) protection vulnerability, classified under CWE-352 and tracked as OVE-20230524-0008, affecting Vasion Print (formerly known as PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 with Application versions prior to 20.0.1923. This flaw enables attackers to bypass CSRF protections in the print management software, which is commonly deployed in enterprise environments for centralized printer administration.
The vulnerability has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low complexity and no required privileges, though it necessitates user interaction. Unauthenticated attackers can craft malicious web pages or links that trick authenticated users—such as administrators—into involuntarily executing unauthorized actions on the Vasion Print appliance, potentially leading to high-impact compromise of confidentiality, integrity, and availability, including data exfiltration, modification of print configurations, or full system takeover.
Mitigation details are outlined in the official PrinterLogic security bulletins available at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm, which security practitioners should consult for patching instructions and workarounds specific to affected versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6054
Vulnerability details
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient CSRF Protection OVE-20230524-0008.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a CSRF vulnerability in a network-accessible web-based print management application, enabling attackers to craft malicious links/pages that trick authenticated users into performing unauthorized high-impact actions on the appliance, directly mapping to exploitation of a public-facing application for initial access or compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires mechanisms to protect session authenticity, preventing CSRF attacks by ensuring state-changing requests cannot be forged by unauthenticated sources.
Mandates timely flaw remediation through patching, directly addressing the insufficient CSRF protection vulnerability in affected Vasion Print versions.
Requires validation of information inputs from external sources, which can include CSRF token checks to mitigate forged requests.