VulnerabilityModified
CVE-2021-42642
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to disclose the plaintext console username and password for a printer.
HIGH 7.5EPSS 1.38%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.38%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to disclose the plaintext console username and password for a printer.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.38% probability · 70th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-312
- Affected
- printerlogic/web stack
- Source
- cve@mitre.org
References
- https://portswigger.net/daily-swig/printerlogic-vendor-addresses-triple-rce-threat-against-all-connected-endpointsThird Party Advisory
- https://securityaffairs.co/wordpress/127194/security/printerlogic-printer-management-suite-flaws.htmlThird Party Advisory
- https://thecyberthrone.in/2022/01/26/printerlogic-%F0%9F%96%A8-fixes-critical-vulnerabilities-in-its-suite/?utm_source=rss&utm_medium=rss&utm_campaign=printerlogic-%25f0%259f%2596%25a8-fixes-critical-vulnerabilities-in-its-suiteThird Party Advisory
- https://www.printerlogic.com/security-bulletin/Vendor Advisory
- https://www.securityweek.com/printerlogic-patches-code-execution-flaws-printer-management-suiteThird Party Advisory
- https://www.yahooinc.com/paranoids/paranoids-vulnerability-research-printerlogic-issues-security-alert/Exploit, Third Party Advisory
- https://portswigger.net/daily-swig/printerlogic-vendor-addresses-triple-rce-threat-against-all-connected-endpointsThird Party Advisory
- https://securityaffairs.co/wordpress/127194/security/printerlogic-printer-management-suite-flaws.htmlThird Party Advisory
- https://thecyberthrone.in/2022/01/26/printerlogic-%F0%9F%96%A8-fixes-critical-vulnerabilities-in-its-suite/?utm_source=rss&utm_medium=rss&utm_campaign=printerlogic-%25f0%259f%2596%25a8-fixes-critical-vulnerabilities-in-its-suiteThird Party Advisory
- https://www.printerlogic.com/security-bulletin/Vendor Advisory
- https://www.securityweek.com/printerlogic-patches-code-execution-flaws-printer-management-suiteThird Party Advisory
- https://www.yahooinc.com/paranoids/paranoids-vulnerability-research-printerlogic-issues-security-alert/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.