PaperCut MF/NG Improper Access Control Vulnerability (CVE-2023-27350)

What is affected, what to do

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update papercut_mf to version 22.0.9, papercut_ng to version 21.2.11. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• PaperCut NG eq 22.0.5 (Build 63914)..22.0.5 (Build 63914)

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade PaperCut MF/NG to a fixed release immediately: 20.1.7, 21.2.11, 22.0.9 or later. Patches are available on portal.papercut.com; verify the build number via the About dialog or server.properties after upgrade.
   • If patching within 24 h is not feasible, restrict the admin web UI (default TCP 9191 HTTP, TCP 9192 HTTPS) with a firewall ACL that only allows dedicated admin jump hosts. User portal on TCP 9163/9164 may continue to operate; the admin UI must not be internet-reachable.
   • Hunt every PaperCut server for prior compromise (actively weaponised since April 2023 for ransomware pre-cursors): look for unknown admin accounts, modified print scripts, new entries under "Print Scripting", and outbound connections to Cobalt Strike / TrueBot infrastructure.
   • Rotate the local service account that runs the PaperCut Application Server (SYSTEM/root context) and any attached LDAP/AD service credentials, since arbitrary code can be executed as SYSTEM.
   • Assess external exposure: run Shodan/Censys queries over your own ASN for the "PaperCut" fingerprint and ports 9191/9192. Treat every exposed instance as potentially compromised until proven otherwise.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: move PaperCut servers into a dedicated print/management VLAN and restrict egress via ACL to required destinations only (printer spoolers, SMTP relay, license endpoint papercut.com). No general internet egress.
   • Place a WAF or reverse proxy in front of the admin UI and block requests to /app?service=page/SetupCompleted and other SetupCompleted endpoints, or allow only authenticated admin sessions through.
   • Apply the vendor workaround: configure a strict allowlist under Options > Advanced > Security > Allowed device IPs for admin access, and temporarily disable "Print Scripting" and "User/Group Sync via custom program" until patched, breaking the observed RCE chain via the scripting interface.
   • Tighten EDR policy on the PaperCut host: block child processes of pc-app.exe or the Java JVM when they spawn cmd.exe, powershell.exe, wscript.exe, certutil.exe, bitsadmin.exe. On Linux, alert on sh/bash as child of the PaperCut JVM.
   • IAM hardening: constrain admin logins to local, non-domain-privileged accounts; reduce PaperCut service account privileges to the minimum the product supports.
   • Back up the PaperCut database and server.properties off-site so a clean rebuild is possible if compromise is confirmed.
3. 03

   Runbook step 3

   Detection rules

   • Web access to the vulnerable path: search access logs for GET or POST with URI matching *SetupCompleted* without a prior authenticated session. Splunk example: index=papercut uri_path="*SetupCompleted*" NOT referer="*login*".
   • Process ancestry (Sysmon EID 1 / EDR): alert when java.exe or pc-app.exe is the parent of cmd.exe, powershell.exe, rundll32.exe or certutil.exe. Sigma skeleton: parent_image|endswith: '\pc-app.exe' plus image|endswith: '\powershell.exe'.
   • File-system monitoring: new files under C:\Program Files\PaperCut MF\server\custom\ or the scripts directory (Sysmon EID 11), especially .js files containing java.lang.Runtime.getRuntime().exec.
   • Network telemetry (Zeek/Suricata): outbound beacons from the PaperCut host to non-print destinations, in particular HTTPS beacons with uniform jitter (Cobalt Strike) or DNS lookups for known TrueBot domains.
   • Windows Event ID 4720/4732: new local admin accounts on the PaperCut host; Event ID 7045 for new services created shortly after hits on /SetupCompleted.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.

Source: pwn.watch, NVD (NIST), CISA KEV Catalog, CVE.org (MITRE), CSA/SingCERT, cvelistv5

Vendors and products

• PaperCut PaperCut NG
• PaperCut PaperCut MF
• PaperCut PaperCut NG

Weakness classes (CWE)

• CWE-284Improper Access Control

  Pillar

  The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

  Entry at MITRE CWE-284

References & sources

• zerodayinitiative.comadvisories/ZDI-23-233Third-party advisory, Vulnerability database
• papercut.comURGENT | PaperCut MF/NG vulnerability bulletin (PO-1216 and PO-1219)Vendor advisory, pwn-watch
• packetstormsecurity.comfiles/171982/PaperCut-MF-NG-Authentication-Bypass-Remote-Code-E…Third-party advisory, Vulnerability database
• packetstormsecurity.comfiles/172022/PaperCut-NG-MG-22.0.4-Authentication-Bypass.htmlExploit, Third-party advisory, Vulnerability database
• news.sophos.comen-us/2023/04/27/increased-exploitation-of-papercut-drawing-blo…Third-party advisory
• packetstormsecurity.comfiles/172512/PaperCut-NG-MG-22.0.4-Remote-Code-Execution.htmlExploit, Third-party advisory, Vulnerability database
• packetstormsecurity.comfiles/172780/PaperCut-PaperCutNG-Authentication-Bypass.htmlExploit, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27350government-resource, US government resource
• pwn.watchpwn.watch: PaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)pwn-watch
• cisa.govMalicious Actors Exploit CVE-2023-27350 in PaperCut MF and NG (AA23-131A)pwn-watch
• NVD (NIST)NVD: CVE-2023-27350pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch