CVE-2023-27350: PaperCut MF/NG Improper Access Control Vulnerability

CVE-2023-27350 is an improper access control vulnerability in PaperCut MF/NG print management software. It resides in the SetupCompleted class and permits an attacker to bypass authentication and achieve code execution in the context of the system account. This matters because successful exploitation can give complete control of the host running PaperCut, and the vulnerability has been used by ransomware operators.

Organizations that rely on PaperCut for print tracking, quotas, or multi-function device management should treat this as a high-priority issue and confirm their exposure against the vendor advisory immediately.

How it works

The weakness is classified as CWE-284 (Improper Access Control). In essence, the software fails to enforce proper authorization checks around a setup-related component. An unauthenticated attacker can reach the SetupCompleted class, bypass normal login requirements, and then execute arbitrary code with system-level privileges on the underlying server.

Because the process runs with elevated rights, the attacker can install malware, create new accounts, move laterally, or deploy ransomware. Exact request formats and payloads are not detailed here; defenders should consult the vendor advisory for the precise attack surface rather than relying on public exploit descriptions.

Am I affected? How to find it in your systems

PaperCut MF and NG are commonly deployed on Windows or Linux servers that act as the central print server or management console for an organization. They are often reachable from internal networks and sometimes from the internet if remote administration or mobile printing features are enabled.

• Inventory: Search configuration management databases, software asset tools, and server inventories for “PaperCut MF” or “PaperCut NG.” Check listening ports and process names associated with the PaperCut application server.
• Version check: Identify the installed build and compare it against the fixed versions listed in the vendor advisory. Do not assume any particular release is safe without confirmation.
• Configuration review: Note whether the management interface is exposed beyond the print-server VLAN and whether any setup or first-run wizards remain accessible.
• Telemetry signs: Look for unexpected authentication-bypass style requests, anomalous process creation under the PaperCut service account, new scheduled tasks, or outbound connections from the print server shortly after unusual web activity. Correlate with EDR alerts for system-level code execution on hosts known to run PaperCut.

How to remediate

The primary action is to apply the vendor-supplied updates exactly as instructed in the official PaperCut advisory for CVE-2023-27350. CISA likewise directs organizations to apply updates per vendor instructions.

• Download and install the patched release on every PaperCut MF/NG instance.
• Restart services only after confirming the update completed successfully.
• After patching, re-validate that the SetupCompleted class is no longer reachable without authentication and that the management interface requires proper credentials.
• As a general hardening step for improper-access-control issues, restrict administrative interfaces to dedicated management networks, enforce least-privilege service accounts, and disable any unused setup or diagnostic endpoints once the system is in production.

If you can't patch immediately

Until the vendor update can be applied, reduce the attack surface with compensating controls:

• Network segmentation: Place PaperCut servers on an isolated VLAN reachable only from authorized print clients and management jump hosts. Block inbound access from the internet and from general user subnets.
• Virtual patching / WAF: If a web application firewall sits in front of the management interface, create temporary rules that block unauthenticated requests to setup-related paths. Confirm rule effectiveness against the vendor’s description of the vulnerable endpoint.
• Feature disablement: If the product allows, turn off any remote setup, first-run, or external authentication features that are not required for daily operations.
• Heightened monitoring: Enable detailed logging on the PaperCut service, forward logs to a SIEM, and alert on any process spawning under the PaperCut system context or on unexpected file writes in the application directories. Prepare an isolation playbook so the host can be taken offline quickly if exploitation is suspected.

If your data may have been exposed

Because this vulnerability has been exploited by ransomware groups, any unpatched PaperCut server that was reachable should be treated as potentially compromised. Conduct a full forensic review of the host, reset credentials that may have been stored or cached by the print server, and examine downstream systems for lateral movement. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether related credentials have already appeared in public dumps.