High severity · published Mar 14, 2024
CVE-2024-1654
This vulnerability potentially allows unauthorized write operations which may lead to remote code execution
7.2
CVSS
1.3%
EPSS
No
On KEV
Description
This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
PaperCut MF/NG · PaperCut
before 20.1.10; 21.0.0 before 21.2.14; 22.0.0 before 22.1.5; 23.0.1 before 23.0.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-1654
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-1654
Vendor Advisory
https://www.papercut.com/kb/Main/Security-Bulletin-March-2024
More from PaperCut MF/NG
9.8
CVE-2026-81578
PaperCut MF/NG: Authentication Bypass
9.8
CVE-2023-27350
PaperCut MF/NG Improper Access Control Vulnerability
9.1
CVE-2026-82078
PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector
8.8
CVE-2023-2533
PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF
7.5
CVE-2023-27351
PaperCut NG/MF Improper Authentication Vulnerability