New Vulnerability: Paper Cut MF/NG | Grey Noise Blog

Summary: CISA added CVE-2023-27350, a critical unauthenticated remote code execution vulnerability (CVSS 9.8) in PaperCut MF and PaperCut NG printer management software, to its Known Exploited Vulnerabilities list on April 21, 2023. The flaw affects application and site servers in version 8.0 and later and is fixed in versions 20.1.7, 21.2.11, and 22.0.9, with PaperCut's advisory citing exploitation reports dating to April 13, 2023, at 15:29 UTC.
Why it matters: GreyNoise observed only two IPs mass scanning for this flaw, which suggests exploitation may be targeted rather than widespread - and that a simple Google search returning a few thousand exposed instances may be all an attacker needs to pick a victim.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-27350
Related: CVE-2023-27350: Paper Cut MF/NG Improper Access Control Vulnerability Known Exploited Vulnerabilities · Apr 21, 2023
Decoding Mass Exploitation in 2023: A Grey Noise Perspective| Grey Noise Blog Cyber Risks ·
Grey Noise Round Up: Product Updates - April 2023 Cyber Risks ·