CVE-2023-27350
PaperCut MF/NG Improper Access Control Vulnerability
Description
CVE-2023-27350 is a critical improper access control vulnerability in PaperCut NG and PaperCut MF print management software. The flaw resides in the SetupCompleted class, where insufficient access control allows remote attackers to bypass authentication entirely and execute arbitrary code with SYSTEM-level privileges. With a CVSS score of 9.8 and an EPSS score of 94.3%, CVE-2023-27350 represents one of the most actively exploited vulnerabilities in enterprise print management. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, and it has been confirmed as a vector for ransomware deployment, making immediate remediation essential for any organization running PaperCut MF or NG.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| papercut | papercut mf | >= 8.0, < 20.1.7; >= 21.0.0, < 21.2.11; >= 22.0.0, < 22.0.9 |
| papercut | papercut ng | >= 8.0, < 20.1.7; >= 21.0.0, < 21.2.11; >= 22.0.0, < 22.0.9 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/171982/PaperCut-MF-NG-Authentication-Bypass-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/172022/PaperCut-NG-MG-22.0.4-Authentication-Bypass.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/172512/PaperCut-NG-MG-22.0.4-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/172780/PaperCut-PaperCutNG-Authentication-Bypass.html(Exploit, Third Party Advisory, VDB Entry)
- https://news.sophos.com/en-us/2023/04/27/increased-exploitation-of-papercut-drawing-blood-around-the-internet/(Third Party Advisory)
- https://www.papercut.com/kb/Main/PO-1216-and-PO-1219(Vendor Advisory)
- https://www.zerodayinitiative.com/advisories/ZDI-23-233/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27350(US Government Resource)
Weakness Type
CWE-284: Improper Access Control
In the context of CVE-2023-27350, the improper access control weakness manifests in PaperCut NG/MF through the SetupCompleted class, which fails to properly restrict access to administrative functionality. This allows unauthenticated remote attackers to bypass the authentication mechanism and gain full control of the print management server, including the ability to execute arbitrary code at the SYSTEM level.
Learn more: CWE-284 — Improper Access Control
Impact Analysis
CVE-2023-27350 carries a CVSS 3.1 score of 9.8 (Critical), reflecting its severe exploitability profile. The vulnerability is remotely exploitable over the network without requiring physical access, and the attack complexity is low, meaning no special conditions or preparation are needed. No authentication is required to exploit this flaw, and no user interaction is necessary, allowing fully automated attacks against exposed PaperCut servers. With high impact across confidentiality, integrity, and availability, a successful exploit grants the attacker complete control over the PaperCut server, including the ability to read sensitive print data, modify configurations, and disrupt print services entirely. The EPSS score of 94.3% (99.9th percentile) indicates near-certain exploitation activity, and CISA has confirmed its use in ransomware campaigns, making this vulnerability an immediate priority for organizations running PaperCut MF or NG.
Exploit Maturity
Public exploit code is widely available for CVE-2023-27350, with multiple proof-of-concept exploits published on Packet Storm Security covering both the authentication bypass and subsequent remote code execution chain. CISA has confirmed active exploitation in the wild and has listed CVE-2023-27350 in its Known Exploited Vulnerabilities catalog, with ransomware operators known to leverage this flaw for initial access into enterprise networks. The EPSS score of 94.3% places this vulnerability in the 99.9th percentile, indicating near-certain exploitation probability. Security researchers at Sophos have documented widespread scanning and exploitation campaigns targeting internet-facing PaperCut instances, and the Zero Day Initiative advisory (ZDI-23-233) provides additional technical details on the attack surface.
Remediation
- Apply vendor patches immediately as directed by CISA: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. PaperCut has released security updates addressing this vulnerability — refer to the vendor advisory (PO-1216 and PO-1219) for specific patch versions for both PaperCut MF and PaperCut NG.
- Upgrade PaperCut MF and NG to the latest patched versions. All versions of PaperCut NG up to and including 22.0.5 (Build 63914) are confirmed vulnerable, so ensure your installation is updated beyond these affected builds.
- Restrict network access to PaperCut administration interfaces by implementing firewall rules and network segmentation. Block external access to the PaperCut web management console (typically port 9191/9192) and limit access to trusted internal IP ranges only.
- Monitor logs for indicators of compromise, including unexpected administrative logins, changes to the SetupCompleted configuration, and any evidence of code execution from the PaperCut service account. Review system event logs for SYSTEM-level process creation originating from PaperCut processes.
- Implement defense-in-depth access controls by enforcing the principle of least privilege on systems hosting PaperCut servers, enabling multi-factor authentication where supported, and conducting regular access control audits to prevent similar improper access control vulnerabilities.
Technical Details
CVE-2023-27350 exploits an improper access control weakness (CWE-284) in the PaperCut NG/MF SetupCompleted class. The vulnerability allows unauthenticated attackers to access the application setup wizard even after initial configuration has been completed, effectively bypassing the authentication mechanism entirely. The attack vector is network-based (AV:N) with low complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N), making it trivially exploitable against any internet-facing PaperCut instance. Once authentication is bypassed, attackers can leverage the administrative functionality to execute arbitrary code in the context of the SYSTEM account, achieving complete compromise of the underlying server. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the maximum impact across all three security pillars — confidentiality, integrity, and availability are all rated high — meaning the attacker can read all data, modify any configuration, and disrupt service availability.
Frequently Asked Questions
Is CVE-2023-27350 being actively exploited?
Yes, CVE-2023-27350 is actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 12, 2023. Ransomware operators are known to use this vulnerability as an initial access vector, and with an EPSS score of 94.3%, exploitation is near-certain for unpatched systems.
What products are affected by CVE-2023-27350?
CVE-2023-27350 affects PaperCut MF and PaperCut NG print management solutions. Specifically, PaperCut NG version 22.0.5 (Build 63914) and earlier versions are confirmed vulnerable. Organizations using any version of PaperCut MF or NG should verify their patch status immediately.
How do I fix CVE-2023-27350?
Apply the security patches released by PaperCut as documented in their advisory PO-1216 and PO-1219. Upgrade to the latest version of PaperCut MF or NG. As an interim measure, restrict network access to the PaperCut web management console and block external access to ports 9191 and 9192.
How severe is CVE-2023-27350?
CVE-2023-27350 is rated Critical with a CVSS 3.1 score of 9.8 out of 10. It requires no authentication and no user interaction to exploit remotely. The EPSS score of 94.3% (99.9th percentile) indicates it is among the most likely vulnerabilities to be exploited, and it has confirmed ransomware associations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.