{"id":"CVE-2023-27350","kind":"vulnerability","aliases":["CVE-2023-27350"],"related":[],"title":"This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5…","description":"This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.","summary":"PaperCut MF/NG print management servers have an improper access control flaw in the SetupCompleted class. An unauthenticated attacker can bypass authentication and run code as the SYSTEM account.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2023-04-21T00:00:00+00:00","products":[{"name":"PaperCut MF/NG","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"PaperCut MF/NG","fixed":["20.1.7","21.2.11","22.0.9"],"affected":">= 8.0.0, <= 19.2.7; >= 20.0.0, <= 20.1.6; >= 21.0.0, <= 21.2.10; >= 22.0.0, <= 22.0.8","ecosystem":"vendor"},{"name":"papercut mf","fixed":["20.1.7"],"affected":">= 8.0, < 20.1.7","ecosystem":"vendor"},{"name":"papercut mf","fixed":["21.2.11"],"affected":">= 21.0.0, < 21.2.11","ecosystem":"vendor"},{"name":"papercut mf","fixed":["22.0.9"],"affected":">= 22.0.0, < 22.0.9","ecosystem":"vendor"},{"name":"papercut ng","fixed":["20.1.7"],"affected":">= 8.0, < 20.1.7","ecosystem":"vendor"},{"name":"papercut ng","fixed":["21.2.11"],"affected":">= 21.0.0, < 21.2.11","ecosystem":"vendor"},{"name":"papercut ng","fixed":["22.0.9"],"affected":">= 22.0.0, < 22.0.9","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","papercut-mf","papercut-ng","ransomware","runtime","self-hosted","windows"],"not_affected_if":["managed-hosting"],"how_to_check":"Check the version under Admin > About. Vulnerable if 8.0.0-19.2.7, 20.0.0-20.1.6, 21.0.0-21.2.10 or 22.0.0-22.0.8 (Application and Site Servers). Look for pc-app.exe spawning cmd.exe or powershell.exe. Review the Application Server log for 'SetupCompleted' lines (server/logs/server.log, debug mode only) outside install or upgrade times, and for '[setup-wizard]' config-key changes. Review printer Scripting for new print scripts. Look for unexpected admin logins or SSH authorized_keys entries. Check DNS and proxy logs for the domains listed in the bulletin.","fix":"Upgrade Application Servers and Site Servers to 20.1.7, 21.2.11 or 22.0.9 or later. Secondary servers (Print Providers) are not affected. If you can't upgrade, block inbound traffic to ports 9191 and 9192 from external IPs. If you suspect compromise, back up, rebuild the server and restore the database from a clean backup.","status":"open","published_at":"2023-04-20T16:15:07+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:06:54+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-10-23T21:06:54Z","model":"claude-haiku-5-5","output":{"fix":"Apply the PaperCut MF/NG update per vendor instructions; the specific fixed version is not stated in the sources.","reach":"network","impact":"high","summary":"PaperCut MF/NG print management servers have an improper access control flaw in the SetupCompleted class. An unauthenticated attacker can bypass authentication and run code as the SYSTEM account.","category":"runtime","who_cares":["papercut-mf","papercut-ng","windows","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs code as SYSTEM on the print server.","analyst_note":"Find the affected and fixed PaperCut MF/NG version ranges and a detection method (log or file check) from the vendor advisory and CISA KEV entry; sources do not give them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000458,"input_tokens":2799,"output_tokens":357,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected and fixed PaperCut MF/NG version ranges and a detection method (log or file check) from the vendor advisory and CISA KEV entry; sources do not give them.","search":"'-2023':17A,20A '-27350':18A,21A '18987':141C '22.0.5':15A,93C '63914':95C 'access':59B,117C 'account':78B 'affect':10A,88C 'allow':3A,81C 'arbitrari':130C 'attack':5A,68B,83C,120C 'authent':8A,71B,86C,96C,127C 'build':94C 'bypass':7A,70B,85C,126C 'class':65B,111C 'code':74B,131C 'context':134C 'control':60B,118C 'cve':16A,19A 'execut':129C 'exist':107C 'exploit':38B,101C 'flaw':61B,106C 'host':49B 'improp':58B,116C 'instal':11A,89C 'issu':113C 'leverag':122C 'manag':54B 'mf':27A,29A,31A,41B 'mf/ng':23A,25A,52B 'ng':14A,33A,35A,37A,44B,92C 'papercut':13A,22A,24A,26A,28A,30A,32A,34A,36A,40B,43B,51B,91C 'papercut-mf':39B 'papercut-ng':42B 'print':53B 'ransomwar':45B 'remot':4A,82C 'requir':99C 'result':114C 'run':73B 'runtim':46B 'self':48B 'self-host':47B 'server':55B 'setupcomplet':64B,110C 'specif':105C 'system':77B,136C 'unauthent':67B 'vulner':2A,80C,103C,124C 'window':50B 'within':108C 'zdi':139C 'zdi-can':138C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-04-20T16:15:07+00:00","kev":{"dateAdded":"2023-04-21","dueDate":"2023-05-12","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-27350","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27350","severity":null,"published_at":"2023-04-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T20:35:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2023-27350:40","url":null,"severity":null,"published_at":"2026-10-23T21:07:44+00:00","modified_at":"2026-10-23T21:07:44+00:00","first_seen_at":"2026-10-23T21:07:44+00:00","fetched_at":"2026-10-23T21:07:44+00:00","note":"PaperCut's own bulletin (PO-1216) gives affected/fixed versions, IOCs and a process-creation detection rule; it confirms exploitation in the wild since 14 Apr 2023. I did not look for a public PoC link."},{"source":"nvd","external_id":"CVE-2023-27350","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27350","severity":null,"published_at":"2023-04-20T16:15:07+00:00","modified_at":"2026-06-17T05:44:50+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[{"id":909,"url":"https://www.papercut.com/kb/Main/PO-1216-and-PO-1219","title":"PaperCut MF/NG vulnerability bulletin (March 2023)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}