CVE-2021-42642: 
PrinterLogic Server vulnerability analysis and mitigation

CVE-2021-42642 is an Insecure Direct Object Reference (IDOR) vulnerability affecting PrinterLogic Web Stack versions 19.1.1.13 SP9 and below. The vulnerability allows an unauthenticated attacker to disclose the plaintext console username and password for a printer (NVD). The vulnerability was discovered in 2021 and was patched in January 2022 with the release of version 19.1.1.13-SP10 (SecurityWeek).

The vulnerability is classified as a Cleartext Storage of Sensitive Information (CWE-312) issue with a CVSS v3.1 base score of 7.5 (High) with the vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD). The vulnerability exists in the printer management functionality where sensitive credentials are stored and can be accessed without proper authentication controls.

The vulnerability allows unauthorized access to printer console credentials in plaintext, potentially enabling attackers to gain control over printer configurations and access sensitive print data. The exposure of administrative credentials could lead to further compromise of the printing infrastructure (SecurityWeek).

While the vulnerability is serious, most PrinterLogic installations are not directly accessible from the Internet. Attackers would need a privileged network position, such as access through a VPN or another vulnerability in an appliance on the edge, to exploit the PrinterLogic Web Stack server (Yahoo Paranoids).

PrinterLogic addressed this vulnerability in Web Stack version 19.1.1.13-SP10. Organizations using affected versions should upgrade to this patched version immediately. For Virtual Appliance users, no client software updates are required. PrinterLogic also automatically pushed patches to its SaaS platform worldwide (SecurityWeek).