{"id":"CVE-2023-27350","published":"2023-04-20T16:15:07Z","modified":"2026-06-17T05:44:50Z","title":"PaperCut MF/NG Improper Access Control Vulnerability","vendor":"PaperCut","product":"MF/NG","tier":"core","eol":null,"description":{"text":"This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.","provenance":"source","from":"NVD"},"summary":{"text":"PaperCut MF/NG's SetupCompleted class contains an improper access control flaw affecting PaperCut NG 22.0.5 (Build 63914). A remote, unauthenticated attacker with network access can bypass authentication and execute arbitrary code as SYSTEM, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:56:39Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":0.99994,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2023-04-21","dueDate":"2023-05-12","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.papercut.com/kb/Main/PO-1216-and-PO-1219;  https://nvd.nist.gov/vuln/detail/CVE-2023-27350","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-04-18","exploitedFirstSeen":"2023-04-18","ransomware":true,"evidence":[{"url":"https://www.papercut.com/kb/Main/PO-1216-and-PO-1219","date":"2023-04-18"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-04-21"},{"url":"https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software","date":"2023-04-21"},{"url":"https://twitter.com/MsftSecIntel/status/1651346653901725696","date":"2023-04-26"},{"url":"https://twitter.com/MsftSecIntel/status/1651346664630755334","date":"2023-04-26"},{"url":"https://news.sophos.com/en-us/2023/04/27/increased-exploitation-of-papercut-drawing-blood-around-the-internet/","date":"2023-04-27"},{"url":"https://www.hhs.gov/sites/default/files/cl0p-lockbit-new-data-breaches-sector-alert.pdf","date":"2023-04-28"},{"url":"https://twitter.com/MsftSecIntel/status/1654610012457648129","date":"2023-05-05"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa23-131a","date":"2023-05-11"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a","date":"2023-05-11"}],"evidenceTotal":827,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"http://packetstormsecurity.com/files/171982/PaperCut-MF-NG-Authentication-Bypass-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/172022/PaperCut-NG-MG-22.0.4-Authentication-Bypass.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/172512/PaperCut-NG-MG-22.0.4-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/172780/PaperCut-PaperCutNG-Authentication-Bypass.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://news.sophos.com/en-us/2023/04/27/increased-exploitation-of-papercut-drawing-blood-around-the-internet/","tags":["Third Party Advisory"]},{"url":"https://www.papercut.com/kb/Main/PO-1216-and-PO-1219","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-23-233/","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/171982/PaperCut-MF-NG-Authentication-Bypass-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/172022/PaperCut-NG-MG-22.0.4-Authentication-Bypass.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/172512/PaperCut-NG-MG-22.0.4-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/172780/PaperCut-PaperCutNG-Authentication-Bypass.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://news.sophos.com/en-us/2023/04/27/increased-exploitation-of-papercut-drawing-blood-around-the-internet/","tags":["Third Party Advisory"]},{"url":"https://www.papercut.com/kb/Main/PO-1216-and-PO-1219","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-23-233/","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27350","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2023-27350 allows an unauthenticated actor to execute malicious code remotely without credentials. Threat actors have been observed exploiting this software through its print scripting interface and installed command and control software on target machines.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"primary_impact","evidence":[],"comment":"CVE-2023-27350 allows an unauthenticated actor to execute malicious code remotely without credentials. Threat actors have been observed exploiting this software through its print scripting interface and installed command and control software on target machines.","confidence":"high"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2023-27350 allows an unauthenticated actor to execute malicious code remotely without credentials. Threat actors have been observed exploiting this software through its print scripting interface and installed command and control software on target machines.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-31126","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-31126","exploited":true,"exploitedSince":"2023-04-21","provenance":"source"},"exploits":[{"id":51391,"url":"https://www.exploit-db.com/exploits/51391","title":"PaperCut NG/MG 22.0.4 - Authentication Bypass","type":"webapps","platform":"multiple","date":"2023-04-25","verified":false,"provenance":"source"},{"id":51452,"url":"https://www.exploit-db.com/exploits/51452","title":"PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE)","type":"webapps","platform":"multiple","date":"2023-05-23","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2023-04-25"},"pocGithub":{"count":12,"skipped":2,"earliest":"2023-04-21","earliestUrl":"https://github.com/MaanVader/CVE-2023-27350-POC","repos":[{"name":"horizon3ai/CVE-2023-27350","url":"https://github.com/horizon3ai/CVE-2023-27350","stars":57,"created":"2023-04-22"},{"name":"imancybersecurity/CVE-2023-27350-POC","url":"https://github.com/imancybersecurity/CVE-2023-27350-POC","stars":12,"created":"2023-04-21"},{"name":"adhikara13/CVE-2023-27350","url":"https://github.com/adhikara13/CVE-2023-27350","stars":9,"created":"2023-04-25"},{"name":"MaanVader/CVE-2023-27350-POC","url":"https://github.com/MaanVader/CVE-2023-27350-POC","stars":5,"created":"2023-04-21"},{"name":"monke443/CVE-2023-27350","url":"https://github.com/monke443/CVE-2023-27350","stars":4,"created":"2025-03-09"}]},"metasploit":[{"name":"PaperCut PaperCutNG Authentication Bypass","module":"exploit/multi/http/papercut_ng_auth_bypass","type":"exploit","disclosureDate":"2023-03-13","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/papercut_ng_auth_bypass.rb"}],"nuclei":[{"id":"CVE-2023-27350","name":"PaperCut - Unauthenticated Remote Code Execution","severity":"critical","path":"http/cves/2023/CVE-2023-27350.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27350.yaml"}],"first":{"date":"2023-03-13","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/papercut_ng_auth_bypass.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/172022/PaperCut-NG-MG-22.0.4-Authentication-Bypass.html","http://packetstormsecurity.com/files/172512/PaperCut-NG-MG-22.0.4-Remote-Code-Execution.html","http://packetstormsecurity.com/files/172780/PaperCut-PaperCutNG-Authentication-Bypass.html","http://packetstormsecurity.com/files/171982/PaperCut-MF-NG-Authentication-Bypass-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1105"],"provenance":"source"}],"timeline":[{"date":"2023-03-13","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-04-21, Exploit-DB 2023-04-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/papercut_ng_auth_bypass.rb","provenance":"source"},{"date":"2023-04-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.papercut.com/kb/Main/PO-1216-and-PO-1219","provenance":"source"},{"date":"2023-04-20","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27350","provenance":"source"},{"date":"2023-04-21","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-04-21","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-31126","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":1},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1292 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 2 Exploit-DB entries; 1 NVD exploit link; 12 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}