OctoPrint-SpoolManager CVE-2025-62169

Requires the OctoPrint-SpoolManager plugin at version 1.7.7/1.8.0a2 or older to be installed, with its blueprint APIs network-reachable to the attacker; no API key, login, or user interaction is needed because the plugin declared is_blueprint_protected() = False and skipped permission checks. The dominant LIMITING factor is the host OctoPrint version: on OctoPrint 1.11.2 and newer the vendor states impact is greatly reduced (reflected in the AC:H metric), so full impact is realistic only against older OctoPrint cores. A secondary practical limit is deployment exposure - OctoPrint instances are commonly bound to a LAN or behind authentication proxies and are not supposed to be internet-facing, narrowing the realistic attacker population.

This is a genuine but conditionally-constrained issue rather than an urgent fire. The confirmed signals are strong on paper: CVSS 8.1 with AV:N/PR:N/UI:N means the plugin's APIs were reachable over the network with no authentication and no user interaction, which the source diff corroborates (the removed is_blueprint_protected() returning False literally meant 'No API key required to request API access', and on_settings_save() had no permission gate before the fix added Permissions.SETTINGS.can()). Against that, several signals argue for a lower real-world priority. EPSS is only 0.45% (37th percentile), there is no CISA KEV listing and no public exploit identified, so there is no evidence of active or imminent mass exploitation - consistent with a niche 3D-printing plugin. The CVSS AC:H is the key tempering factor and aligns with the vendor's own statement that impact is 'greatly reduced' on OctoPrint 1.11.2+, i.e. full exploitation depends on a target condition outside the attacker's control (older OctoPrint host). No signals outright conflict, but note the tension: the vector claims C:H/I:H/A:H (via NVD) while the described impact is unauthorized read/write of spool metadata and plugin settings - the 'High' triad is defensible given settings manipulation and exposed default DB credentials, but defenders should treat the A:H in particular as an upper-bound estimate, not a confirmed destructive capability.

An attacker who can reach an OctoPrint instance exposing the SpoolManager plugin (e.g. an internet-facing or LAN-accessible printer host) sends direct HTTP requests to the plugin's blueprint APIs, which perform no authentication or authorization checks. Without any API key or login, the attacker reads spool metadata and invokes settings operations such as saving/resetting plugin settings. No public exploit code was identified at time of analysis, though the patch commit publicly reveals the missing-permission root cause, lowering the effort to reproduce.