CVE-2025-27667

The flaw, classified as CWE-203 (Observable Discrepancy), involves the application returning different responses depending on whether a provided email address exists in the system as an administrator account. An attacker, by sending appropriately crafted network requests without any authentication, can determine which email addresses are assigned to administrative accounts based on the observed differences in system responses. The vulnerability is remotely accessible without requiring any privileges or user interaction.

An attacker can collect a list of administrative account email addresses, which facilitates targeted phishing attacks, credential stuffing, or brute-force attacks on these accounts, potentially leading to the compromise of administrative privileges over the print system.

Vasion Print must be updated to Virtual Appliance Host version 22.0.843 or later and Application 20.0.1923 or later. Detailed information is available in the manufacturer's security bulletins at https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm

Vasion Print (formerly PrinterLogic) in Virtual Appliance Host versions below 22.0.843 and Application versions below 20.0.1923