An unauthenticated RCE flaw (CVE-2023-27350) in widely-used PaperCut MF and NG print management software is being exploited by attackers to take over vulnerable application servers, and now there’s a public PoC exploit. About the vulnerability According to PaperCut, the attacks seem to have started on April 14, 2023 – a month and a week after the software maker released new PaperCut MF and NG versions that fixed CVE-2023-27350 and CVE-2023–27351, an unauthenticated information disclosure flaw that could allow attackers to access sensitive user information (usernames, email addresses, office/department information, and card numbers) without authentication.

Read full article on Help Net Security