Cyber Resilience

CVE-2025-27673

Printerlogic Vasion Print ≤ 20.0.1923

Published
05 March 2025
Modified
01 April 2025
Patch / advisory
View advisory
CVSS Score v3.1 9.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0053 42th percentile
Risk Priority 67 floored blend · peak EPSS

Summary

CVE-2025-27673 is a critical-severity Use of Persistent Cookies Containing Sensitive Information (CWE-539) vulnerability in Printerlogic Vasion Print. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Steal Web Session Cookie (T1539); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-27673 is a high-severity vulnerability (CVSS 9.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) affecting Vasion Print, formerly known as PrinterLogic, specifically versions of the Virtual Appliance Host before 22.0.843 Application 20.0.1923. The issue, tracked as OVE-20230524-0017 and mapped to CWE-539, involves cookies being returned in the response body, which can lead to information exposure.

Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation enables high-impact confidentiality and integrity violations, such as potential session hijacking or unauthorized access to sensitive data through exposed cookies.

Mitigation details and security bulletins are available from the vendor at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm. The CVE was published on 2025-03-05T06:15:40.167.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cookie Returned in Response Body OVE-20230524-0017.

CWE(s)
CWE-539

Related Threats

MITRE ATT&CK Enterprise Techniques

T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
attack.mitre.org →
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
T1528 Steal Application Access Token Credential Access
Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-27661Same product: Printerlogic Vasion Print
CVE-2025-27653Same product: Printerlogic Vasion Print
CVE-2025-27654Same product: Printerlogic Vasion Print
CVE-2025-27679Same product: Printerlogic Vasion Print
CVE-2025-27676Same product: Printerlogic Vasion Print
CVE-2025-27660Same product: Printerlogic Vasion Print
CVE-2025-27637Same product: Printerlogic Vasion Print
CVE-2025-27675Same product: Printerlogic Vasion Print
CVE-2025-27672Same product: Printerlogic Vasion Print
CVE-2025-27641Same product: Printerlogic Vasion Print

Affected Assets

printerlogic
vasion print
≤ 20.0.1923
printerlogic
virtual appliance
≤ 22.0.843

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure SDLC practices and coding standards directly prohibit storing sensitive data in persistent cookies.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect and prevent use of persistent cookies with sensitive data.

A.5.34 Privacy and protection of PII partial match
mitigates

Privacy and PII protection policies require safeguards against exposing sensitive data via cookies.

A.8.1 User end point devices partial match
degrades

Endpoint device configuration can enforce cookie lifetime and encryption policies.

A.8.10 Information deletion partial match
mitigates

Information deletion policies can mandate removal or encryption of sensitive cookie data.

A.8.12 Data leakage prevention partial match
mitigates

Data leakage prevention controls can block or encrypt sensitive information in cookies.

A.8.24 Use of cryptography partial match
degrades

Cryptographic controls can mandate encryption of sensitive data stored in cookies.

References