CVE-2025-27668

The vulnerability classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) allows an attacker to embed arbitrary external resources in the application interface through an uncontrolled Iframe element. The mechanism does not require an account or any form of authorization, and network connectivity to the vulnerable instance is sufficient to conduct the attack. By injecting malicious content, the attacker can manipulate what the user sees and interacts with in the context of the printer management application.

An attacker can achieve complete compromise of system confidentiality, integrity, and availability — particularly theft of authentication credentials, execution of malicious code in the victim's browser, or manipulation of the application interface to further escalate the attack.

Vasion Print should be updated to Virtual Appliance Host version 22.0.843 or later and Application version 20.0.1923 or later. Detailed information is available in the vendor's security bulletin at: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm

Vasion Print (formerly PrinterLogic) in Virtual Appliance Host versions below 22.0.843 and Application versions below 20.0.1923