CVE-2025-27675
Published: 05 March 2025
Summary
CVE-2025-27675 is a critical-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Printerlogic Vasion Print. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely identification, reporting, and correction of critical software flaws like the vulnerable OpenID implementation in Vasion Print Virtual Appliance Host.
Enables proactive vulnerability scanning and monitoring to identify CVE-2025-27675 in affected PrinterLogic versions prior to exploitation.
Mandates receiving and responding to vendor security advisories documenting the OpenID vulnerability V-2023-004, facilitating awareness and patching.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a critical remote unauthenticated vulnerability in a public-facing application (Vasion Print Virtual Appliance) allowing sensitive information exposure with high impact, directly mapping to exploitation of public-facing applications.
NVD Description
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Vulnerable OpenID Implementation V-2023-004.
Deeper analysisAI
CVE-2025-27675 affects Vasion Print, formerly known as PrinterLogic, specifically versions of the Virtual Appliance Host before 22.0.843 with Application 20.0.1923. The vulnerability stems from a flawed OpenID implementation designated V-2023-004 and is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impacts across confidentiality, integrity, and availability.
An unauthenticated attacker can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation grants high-level access to sensitive information and enables significant disruption, including manipulation of data (high integrity impact) and denial of service (high availability impact).
Mitigation details and security bulletins are documented in vendor advisories at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm, along with independent analysis at https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html and a Full Disclosure mailing list post at http://seclists.org/fulldisclosure/2025/Apr/18. Upgrading to Virtual Appliance Host 22.0.843 Application 20.0.1923 or later addresses the issue.
Details
- CWE(s)