CVE-2025-27667
Published: 05 March 2025
Summary
CVE-2025-27667 is a critical-severity Observable Discrepancy (CWE-203) vulnerability in Printerlogic Vasion Print. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Email Addresses (T1589.002); ranked in the top 34.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-11 (Error Handling) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-27667 is an Administrative User Email Enumeration vulnerability, tracked as OVE-20230524-0011, affecting Vasion Print (formerly known as PrinterLogic) Virtual Appliance versions prior to Host 22.0.843 Application 20.0.1923. The issue stems from CWE-203 (Observable Discrepancy), where differences in system responses allow inference of valid administrative user email addresses. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to high impacts across confidentiality, integrity, and availability.
Unauthenticated attackers with network access can exploit this vulnerability with low complexity and no user interaction required. By sending crafted requests, they can enumerate valid administrative email addresses, potentially enabling further targeted attacks such as phishing, credential stuffing, or social engineering against administrators.
The PrinterLogic security bulletin at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm provides details on mitigation, including upgrading to Virtual Appliance Host 22.0.843 Application 20.0.1923 or later.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6051
Vulnerability details
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Administrative User Email Enumeration OVE-20230524-0011.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability directly enables unauthenticated enumeration of valid administrative user email addresses through observable response discrepancies, mapping to T1589.002 for gathering victim identity information (email addresses).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Prevents attackers from enumerating administrative emails by ensuring no discernible differences in system responses to valid versus invalid inputs.
Remediates the specific CWE-203 observable discrepancy flaw through timely flaw identification, reporting, and patching via vendor upgrade.
Monitors for events like crafted requests that indicate attempts to disclose administrative user email information through response analysis.