PaperCut Zero-Day Under Active Attack: Emergency Patch Released
PaperCut warns that a zero-day in NG and MF print management products is being actively exploited, shipping emergency patches with no CVE assigned yet.
PaperCut Software confirmed active exploitation of a zero-day affecting PaperCut NG and MF, with confirmed customer incidents, and released emergency patches on Friday ahead of technical details or a CVE assignment. The company urges customers to restrict web access to trusted IP addresses, disconnect application servers from the internet, and watch for indicators including tampered or truncated server.log files, database error strings, and suspicious activity involving pc-app.exe. The article recalls the May 2023 exploitation of CVE-2023-27350 and CVE-2023-27351 by the financially motivated Lace Tempest group, a Clop ransomware RaaS affiliate, though no attacker attribution has been given for the current campaign.
- Active zero-day exploitation of PaperCut NG/MF with confirmed customer incidents; no CVE yet assigned.
- Emergency patches released; PaperCut urges restricting web interfaces to trusted IPs or disconnecting from the internet.
- Attackers may delete, truncate or alter server.log files; database error strings and pc-app.exe activity serve as IoCs.
- In 2023, Lace Tempest, a Clop RaaS affiliate, exploited PaperCut flaws CVE-2023-27350 and CVE-2023-27351.
- Products
- PaperCut NGPaperCut MF
- Threat actors
- Lace TempestDEV-0950
- Malware
- Raspberry Robin
- Organizations
- Clop
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-27350 | Authentication Bypass Leading to SYSTEM RCE in PaperCut MF/NG | 9.8 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2023-27351 | Authentication Bypass in PaperCut NG/MF Print Management Software | 7.5 | 78% | KEVRansomware | KEV |
From the original article
2 min read at securityaffairs.com
PaperCut warns that a zero-day in NG and MF is being exploited. The company already release emergency patches to address it. PaperCut Software warns that attackers are actively exploiting a zero-day in its NG and MF print management products.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.