CVE Vulnerability Advisory Database

[Affected Scope] PaperCut MF and PaperCut NG print management solutions

[Impact] Attackers capable of manipulating system configuration parameters can execute arbitrary Java bytecode under the security context of the PaperCut server process

[Mitigation] Apply the official vendor security patches immediately and restrict access to database configuration utilities

[Affected Scope] Web management interface of PaperCut MF and PaperCut NG.

[Impact] Unauthenticated remote attackers can trigger backend actions and modify system configurations before access validation checks complete, potentially leading to Remote Code Execution (RCE).

[Mitigation] Apply the official vendor security patches immediately and restrict external access to the web management ports (default 9191, 9192).

[Affected Scope] PaperCut NG and MF systems with an active administrator login session.

[Impact] Attackers can trick administrators into clicking malicious links, leading to unauthorized security setting modifications and arbitrary code execution.

[Mitigation] Apply the official vendor security patches immediately and restrict external access to the admin interface.

[Affected Scope] PaperCut NG and MF versions 22.0.5 (Build 63914) and earlier

[Impact] Unauthenticated remote attackers can bypass authentication to gain administrative access and execute arbitrary code with system privileges

[Mitigation] Immediately upgrade to the latest patched versions (22.0.9 or higher) and restrict external access to management ports 9191 and 9192