CVE-2021-42637: 
PrinterLogic Server vulnerability analysis and mitigation

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below contain a Server Side Request Forgery (SSRF) vulnerability identified as CVE-2021-42637. The vulnerability was discovered by The Paranoids, Yahoo's vulnerability research team, between April and June 2021, and was patched by PrinterLogic (Vasion) in January 2022 with the release of version 19.1.1.13-SP10 (Paranoids Research, SecurityWeek).

The vulnerability is classified as a blind SSRF issue. To exploit the vulnerability, attackers would need a privileged network position, such as access through a VPN or another vulnerability in an appliance on the edge, as most PrinterLogic installations are not directly accessible from the Internet. The vulnerability received a CVSS base score of 9.8 (Critical) (NVD).

If successfully exploited, the vulnerability could allow attackers to perform server-side request forgery attacks against the affected systems. This could potentially lead to unauthorized access to internal resources and information disclosure (SecurityWeek).

The vulnerability requires a privileged network position for exploitation. Most PrinterLogic installations are not directly accessible from the Internet, which somewhat limits the attack surface. Attackers would need access through a VPN or another vulnerability in an edge appliance to exploit the PrinterLogic Web Stack server (Paranoids Research).

PrinterLogic addressed the vulnerability in Web Stack version 19.1.1.13-SP10 released on January 21, 2022. Organizations using affected versions should upgrade to the patched version. For Virtual Appliance users, no client software updates are required. PrinterLogic also automatically pushed patches to its SaaS platform worldwide (SecurityWeek).