PaperCut · MF/NG
CVE-2023-27350
PaperCut MF/NG Improper Access Control Vulnerability
What it is
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
CISA: PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 12, 2023
- Added to the CISA list
- April 21, 2023
- Published
- April 20, 2023
- Severity
- Critical 9.8 CVSS 3.0
- Chance of attacks in the next 30 days (EPSS)
- >99.9% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-284
- More details
- NVD · CVE.org · CISA
All references (7)
- https://www.zerodayinitiative.com/advisories/ZDI-23-233/
- https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
- http://packetstormsecurity.com/files/171982/PaperCut-MF-NG-Authentication-Bypass-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/172022/PaperCut-NG-MG-22.0.4-Authentication-Bypass.html
- https://news.sophos.com/en-us/2023/04/27/increased-exploitation-of-papercut-drawing-blood-around-the-internet/
- http://packetstormsecurity.com/files/172512/PaperCut-NG-MG-22.0.4-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/172780/PaperCut-PaperCutNG-Authentication-Bypass.html
More exploited flaws from PaperCut
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 31, 2026 | Missing Authentication for Critical Function | NG/MF | High 8.8 | 84% |
| Aug 31, 2026 | Unsafe Reflection | NG/MF | Critical 9.4 | 61% |
| Apr 20, 2026 | Improper Authentication | NG/MF | High 8.2 | 78% |
| Jul 28, 2025 | Cross-Site Request Forgery (CSRF) | NG/MF | High 8.4 | 29% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.