PaperCut NG/MF
CVE-2023-27351
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessScan internet for PaperCut admin port
-
DeliverySend crafted request to SecurityRequestFilter
-
ExploitBypass authentication into admin session
-
ExecutionEnable user-sync scripting interface
-
PersistExecute arbitrary code as service account
-
ImpactDeploy loader or ransomware payload
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of PaperCut NG and PaperCut MF when the administrative web interface (typically TCP 9191/9192) is reachable by the attacker. Limiting factors: the target server must be network-reachable on the admin UI port, so installations whose admin interface is firewalled to internal management networks are not exploitable from the internet; servers patched to 20.1.7, 21.2.11, 22.0.9 or later are not vulnerable; and meaningful post-exploitation impact (RCE) requires the built-in Scripting interface, which is enabled by default in affected versions. |
| Impact | Risk is critical despite the CVSS base score of 7.5 reflecting only confidentiality impact (C:H/I:N/A:N) - multiple signals align strongly. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated, no-user-interaction exploitation, which is the worst-case profile for an internet-facing service. EPSS at 44.63% (98th percentile) is exceptionally high, CISA KEV listing confirms active in-the-wild exploitation, and public POC code lowers the skill bar. The CVSS scope is also conservative: although the base score only counts confidentiality impact from the bypass itself, real-world exploitation has been observed chaining this bypass into the built-in administrative scripting interface to achieve full remote code execution, so defenders should treat the practical impact as significantly higher than the 7.5 score suggests. |
| Exploit ScenarioDerived | An attacker locates an internet-exposed PaperCut server on port 9191/9192 via Shodan or similar scanning, then sends a crafted HTTP request that abuses the SecurityRequestFilter flaw to obtain an authenticated admin session without credentials. Using the public POC, they then enable the built-in user/group sync scripting interface and execute arbitrary commands on the host as the PaperCut service account, frequently observed dropping Cobalt Strike or TrueBot loaders. This scenario reflects activity attributed by CISA, FBI, and MS-ISAC to ransomware operators including Cl0p and LockBit affiliates. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Authentication bypass in PaperCut NG and PaperCut MF print management software allows unauthenticated remote attackers to access protected functionality by exploiting flawed logic in the SecurityRequestFilter class. The flaw is confirmed actively exploited (CISA KEV) and has publicly available exploit code, with an EPSS score of 44.63% (98th percentile) indicating very high exploitation likelihood. It is commonly chained with administrative scripting features to achieve remote code execution on exposed PaperCut servers.
RemediationAI
Vendor-released patch: upgrade PaperCut MF/NG to version 20.1.7, 21.2.11, 22.0.9, or later according to your installed major release branch, per the PaperCut security bulletin. If immediate patching is not possible, restrict network access to the PaperCut server administrative interface (default TCP port 9191/HTTPS 9192) to a trusted management subnet via firewall or reverse proxy ACL - this blocks the bypass at the network layer but breaks remote administration. Additionally, enable 'Allow list of IP addresses' under Options > Advanced > Security to limit administrator UI access to known management hosts, which has minimal user-facing impact but does not protect against attackers on those same subnets. Monitor for indicators of compromise published in the PaperCut advisory and CISA alerts, including unexpected use of the Scripting interface or new admin-created users.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PaperCut NG and PaperCut MF are widely deployed print management server applications used by enterprises, universities, and government agencies to track and control printing. The vulnerability falls under CWE-287 (Improper Authentication) and resides specifically in the SecurityRequestFilter Java class, which is responsible for validating session state on incoming HTTP requests to the PaperCut administrative web interface. Due to an improper implementation of the authentication algorithm, the filter can be tricked into treating a request as already authenticated, granting access to administrator-only functionality without valid credentials. The affected CPEs cover multiple version ranges of both papercut_ng and papercut_mf product lines, with PaperCut NG 22.0.5 (Build 63914) explicitly named in the original disclosure (ZDI-CAN-19226).
Know when Papercut Ng gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.
Executive ViewAI
PaperCut NG and MF print management systems are vulnerable to an unauthenticated remote authentication bypass (CVE-2023-27351) that allows attackers to access protected administrative functionality. This vulnerability is confirmed actively exploited (CISA KEV) with no vendor patch currently available. Organizations relying on PaperCut for print infrastructure face immediate risk of administrative compromise and potential remote code execution, requiring urgent defensive action.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network isolation-restrict all PaperCut administrative access to dedicated administrative networks with strict IP whitelisting; (2) Feature restriction-disable or remove unnecessary administrative scripting capabilities; (3) Enhanced monitoring-deploy intrusion detection rules and access logs targeting exploitation of the authentication bypass; (4) Incident preparedness-maintain configuration backups and develop rapid remediation procedures in case of compromise detection; (5) Alternative evaluation-assess print management alternatives to reduce dependency on potentially compromised systems.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)NVD
More in Papercut Ng
View allThis vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bui
PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF, which, under specific condition
PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Rated medium severity (CVSS 6.5), this vuln
This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated
An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19
PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163. Rat
An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print
An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabl
An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print
An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated att
This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for
GitHub PoC
Exploit-DB