Start with Identity
Subscribe
Identity CVE · Other

CVE-2023-27350PaperCut NG/MF auth bypass to remote code execution

criticalCISA KEVActively exploited
Product: PaperCut NG/MFVendor: PaperCutDisclosed: 2023-04-20Status: Actively exploitedNVD ↗CISA KEV ↗

What broke

PaperCut NG/MF allowed an unauthenticated caller to reach a setup/scripting surface and execute code (ZDI-CAN-18987). CVE-2023-27351 is the companion improper-authentication ID. Horizon3 published a public PoC. CISA KEV. Bloody/Bl00dy and other ransomware crews used it in April-May 2023. Fixed in 22.0.9 / 21.2.11 / 20.1.7.

Why it matters

Print management is not "facilities software." It binds to AD, stores user sync credentials, and sits on the internal network with a forgotten admin UI. An auth bypass there is an identity foothold that never touches the IdP.

What to do

  • Confirm every NG/MF application and site server is past those builds. Hive/Pocket were not affected.
  • Rotate the AD account PaperCut uses to sync users.
  • Take port 9191/9192 off the internet. Hunt for new admin users and unexpected print-script jobs.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.