CVE-2025-27666
Published: 05 March 2025
Summary
CVE-2025-27666 is a critical-severity Missing Authorization (CWE-862) vulnerability in Printerlogic Vasion Print. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-27666 is a vulnerability involving insufficient authorization checks (CWE-862, identified as OVE-20230524-0010) in Vasion Print, formerly known as PrinterLogic. It affects versions before Virtual Appliance Host 22.0.843 Application 20.0.1923. The issue was published on 2025-03-05 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for widespread impact.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation grants high-impact access to confidentiality, integrity, and availability, enabling attackers to potentially read, modify, or delete data, execute arbitrary code, or disrupt services on affected systems.
Mitigation details are available in the vendor's security bulletin at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6052
Vulnerability details
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Authorization Checks OVE-20230524-0010.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes insufficient authorization checks enabling unauthenticated remote exploitation of a public-facing application (Vasion Print/PrinterLogic), directly mapping to T1190: Exploit Public-Facing Application. The critical severity and potential for arbitrary code execution, data access, or service disruption confirm this as the primary technique facilitated by the vulnerability.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 mandates enforcement of approved authorizations for access to system resources, directly addressing the insufficient authorization checks that enable unauthenticated remote exploitation.
SI-2 requires timely identification, reporting, and remediation of flaws like CVE-2025-27666 through patching to virtual appliance versions 22.0.843 and later.
AC-6 enforces least privilege to restrict the impact of unauthorized access even when authorization checks are insufficient.