Actively exploited in the wild

PaperCut MF/NG Improper Access Control Vulnerability

PaperCut - MF/NG · Listed in the CISA KEV since 2023-04-21. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2023-27350

CriticalCVSS 9.8KEV

Published: 20/04/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required. The flaw exists within the SetupCompleted class due to improper access control. An attacker can bypass authentication and execute arbitrary code in the context of SYSTEM.

Risk Assessment

An attacker could gain full control of the PaperCut server with SYSTEM privileges, potentially leading to a severe security breach.

Recommendation

Immediately update PaperCut NG to the latest version. Check for unauthorized access.

Other vulnerabilities in PaperCut NG

CVE-2023-3486High
An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut NG host’s file storage.

Original NVD description (English source)

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.