CVE-2025-27682
Published: 05 March 2025
Summary
CVE-2025-27682 is a critical-severity Incorrect Default Permissions (CWE-276) vulnerability in Printerlogic Vasion Print. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AU-9 (Protection of Audit Information).
Deeper analysis
CVE-2025-27682 is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) involving insecure log permissions (CWE-276, designated V-2022-005) in Vasion Print, formerly known as PrinterLogic. It affects the Virtual Appliance Host before version 1.0.735 Application 20.0.1330.
The vulnerability enables exploitation by remote, unauthenticated attackers requiring low complexity and no user interaction. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially allowing full system compromise.
Advisories recommend upgrading to Virtual Appliance Host 1.0.735 Application 20.0.1330 or later for mitigation. Relevant details are provided in PrinterLogic's security bulletins at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm, Pierre Kim's analysis of 83 Vasion/PrinterLogic vulnerabilities at https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html, and a Full Disclosure mailing list post at http://seclists.org/fulldisclosure/2025/Apr/18.
This vulnerability was published on 2025-03-05 and is part of a larger set of 83 flaws highlighted in independent research.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6036
Vulnerability details
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Insecure Log Permissions V-2022-005.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote unauthenticated vulnerability (AV:N/PR:N) in a public-facing virtual appliance with insecure log permissions, directly enabling exploitation of public-facing applications (T1190) and unauthorized access to local system data via exposed logs (T1005), leading to high-impact compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AU-9 requires protection of audit information from unauthorized access, modification, deletion, and fabrication, directly mitigating insecure log permissions that enable remote attackers to compromise confidentiality, integrity, and availability.
AC-3 enforces approved logical access authorizations on system resources including log files, preventing unauthenticated remote access to insecurely permissioned logs.
CM-6 establishes secure configuration settings for components like log files to enforce restrictive permissions consistent with least privilege and operational needs.