Back to CVE Browser

CVE-2023-27350

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2023-04-20

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.

Affected Platforms (CPE)

📦

Papercut

Papercut Mf

>= 8.0 and < 20.1.7>= 21.0.0 and < 21.2.11>= 22.0.0 and < 22.0.9

📦

Papercut

Papercut Ng

>= 8.0 and < 20.1.7>= 21.0.0 and < 21.2.11>= 22.0.0 and < 22.0.9

References & Advisories

🔗 http://packetstormsecurity.com/files/171982/PaperCut-MF-NG-Authentication-Bypass-Remote-Code-Execution.html

🔗 http://packetstormsecurity.com/files/172022/PaperCut-NG-MG-22.0.4-Authentication-Bypass.html

🔗 http://packetstormsecurity.com/files/172512/PaperCut-NG-MG-22.0.4-Remote-Code-Execution.html

🔗 http://packetstormsecurity.com/files/172780/PaperCut-PaperCutNG-Authentication-Bypass.html

🔗 https://news.sophos.com/en-us/2023/04/27/increased-exploitation-of-papercut-drawing-blood-around-the-internet/

🔗 https://www.papercut.com/kb/Main/PO-1216-and-PO-1219

🔗 https://www.zerodayinitiative.com/advisories/ZDI-23-233/

🔗 http://packetstormsecurity.com/files/171982/PaperCut-MF-NG-Authentication-Bypass-Remote-Code-Execution.html

Related Vulnerabilities

An insecure process execution vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for...

CVE-2025-97857.7

PaperCut Print Deploy is an optional component that integrates with PaperCut NG/MF which simplifies printer deployment and managem...

CVE-2024-96726.3

A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created...

CVE-2023-394707.2

PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remot...