CVE-2025-27670
Published: 05 March 2025
Summary
CVE-2025-27670 is a critical-severity Improper Verification of Cryptographic Signature (CWE-347) vulnerability in Printerlogic Vasion Print. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-14 (Signed Components) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-27670 is an Insufficient Signature Validation vulnerability, identified as OVE-20230524-0014 and mapped to CWE-347 (Improper Authentication), affecting Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 Application 20.0.1923. Published on 2025-03-05, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.
Remote attackers require no privileges, authentication, or user interaction to exploit this over the network with low attack complexity. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, enabling outcomes such as arbitrary code execution or full system compromise on affected appliances.
Mitigation guidance is available in PrinterLogic's security bulletin at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm, which details patching to Virtual Appliance Host 22.0.843 Application 20.0.1923 or later to address the signature validation flaw.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6048
Vulnerability details
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Signature Validation OVE-20230524-0014.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated remote code execution flaw in a public-facing virtual appliance (insufficient signature validation allowing arbitrary code execution or full compromise), directly enabling T1190 Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires software components to be digitally signed and signatures validated prior to installation or execution, directly preventing exploitation of insufficient signature validation flaws.
Mandates cryptographic integrity checks such as signatures on software and firmware at startup or periodically, blocking tampered components due to improper validation.
Requires timely identification, reporting, and correction of flaws like this signature validation vulnerability via vendor patching to version 22.0.843 Application 20.0.1923 or later.