VULNERABILITY INTELLIGENCE
CVE-2023-27350
CVSS score9.8 CRITICAL
EPSS probability100.00%
CISA KEVKnown exploited vulnerability
Published2023-04-20
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Known Exploited Vulnerability
PaperCut MF/NG Improper Access Control Vulnerability
Vendor / product: PaperCut / MF/NG
Description
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
Weakness classification
- zdi-disclosures@trendmicro.com: CWE-284
- nvd@nist.gov: NVD-CWE-Other
Primary references
- zdi-disclosures@trendmicro.com — Third Party Advisory, VDB Entry
- zdi-disclosures@trendmicro.com — Exploit, Third Party Advisory, VDB Entry
- zdi-disclosures@trendmicro.com — Exploit, Third Party Advisory, VDB Entry
- zdi-disclosures@trendmicro.com — Exploit, Third Party Advisory, VDB Entry
- zdi-disclosures@trendmicro.com — Third Party Advisory
- zdi-disclosures@trendmicro.com — Vendor Advisory
- zdi-disclosures@trendmicro.com — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory