CVE-2025-27648

The vulnerability is classified as CWE-522 (Insufficiently Protected Credentials) and consists of improper isolation of authentication data between tenants in the multi-tenant architecture of the Vasion Print system. An attacker operating within the context of one tenant can gain access to credentials (passwords) assigned to another tenant, without the need for authentication, user interaction, or elevated privileges — which is confirmed by a network vector with no prerequisites (AV:N/AC:L/PR:N/UI:N).

An attacker can obtain passwords of other organizations using the same Vasion Print instance, which may lead to account takeover, unauthorized access to network resources, and large-scale violation of data confidentiality and integrity.

Vasion Print should be updated to Virtual Appliance Host version 22.0.913 or later and Application version 20.0.2253 or later as soon as possible. Detailed information is available in the vendor's security bulletin at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm

Vasion Print (formerly PrinterLogic) — Virtual Appliance Host in versions prior to 22.0.913 and Application in versions prior to 20.0.2253