CVE-2023-27350

criticalpriority · act · 90KEV · exploitedEPSS 1.000 · 100 %ileexploit · weaponizedEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 17 exploits · weaponized

Likely / severe?

100.0% (100th) EPSS

CVSS 9.8 · critical

Is it mine?

15 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

added 2023-04-21remediate by 2023-05-12

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-21

PaperCut MF/NG Improper Access Control Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · zdi-disclosures@trendmicro.comexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-284USCWE-284US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (17)

Public proof-of-concept and weaponised exploit code.

exploit/multi/http/papercut_ng_auth_bypassPaperCut PaperCutNG Authentication Bypassweaponized · metasploit
EDB-51391PaperCut NG/MG 22.0.4 - Authentication BypassPoC · exploit_db
EDB-51452PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE)PoC · exploit_db
0xB0y426/CVE-2023-27350-PoCPoC for CVE-2023-27350PoC · poc_in_github
ASG-CASTLE/CVE-2023-27350ASG-CASTLE/CVE-2023-27350PoC · poc_in_github
Ap0dexMe0/CVE-2023-27350Perfom With Massive Authentication Bypass In PaperCut MF/NGPoC · poc_in_github

affected products (15)

Products and version ranges known to be affected.

PaperCut NG≤ 22.0.5 (Build 63914)enisa_euvdEU
PaperCut Software International Pty Ltd PaperCut MF≤ с 8.0.0 по 19.2.7fstec_bduRU
PaperCut Software International Pty Ltd PaperCut MF≤ с 20.0.0 по 20.1.6fstec_bduRU
PaperCut Software International Pty Ltd PaperCut MF≤ с 21.0.0 по 21.2.10fstec_bduRU
PaperCut Software International Pty Ltd PaperCut MF≤ с 22.0.0 по 22.0.8fstec_bduRU
PaperCut Software International Pty Ltd PaperCut NG≤ с 20.0.0 по 20.1.6fstec_bduRU
PaperCut Software International Pty Ltd PaperCut NG≤ с 22.0.0 по 22.0.8fstec_bduRU
PaperCut Software International Pty Ltd PaperCut NG≤ с 21.0.0 по 21.2.10fstec_bduRU
PaperCut Software International Pty Ltd PaperCut NG≤ с 8.0.0 по 19.2.7fstec_bduRU
papercut papercut mf21.0.0 → 21.2.11nvdUScpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*
papercut papercut mf22.0.0 → 22.0.9nvdUScpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*
papercut papercut mf8.0 → 20.1.7nvdUScpe:2.3:a:papercut:papercut_mf:*:*:*:*:*:*:*:*
papercut papercut ng21.0.0 → 21.2.11nvdUScpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*
papercut papercut ng22.0.0 → 22.0.9nvdUScpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*
papercut papercut ng8.0 → 20.1.7nvdUScpe:2.3:a:papercut:papercut_ng:*:*:*:*:*:*:*:*

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2023-04-20modified 2026-06-17

references (26)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan