CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HThis vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
PaperCut has confirmed a zero-day vulnerability is being actively exploited in its print management software, impacting all versions of NG and MF. The company released a patch and urges users to restrict internet access…
