PaperCut CVE-2023-39143 Affects Windows Servers Below Version 22.1.3
Summary
Huntress reported that Windows PaperCut MF and NG servers below 22.1.3 are affected by CVE-2023-39143. It advised patching or, if patching is delayed, restricting internet access or disabling external hardware integration.
Key points
- Huntress said it was made aware of CVE-2023-39143 on August 5, 2023.
- The article identifies Windows PaperCut MF and NG servers below version 22.1.3 as vulnerable.
- Huntress reported more than 1,000 vulnerable servers across 812 companies in its partner base.
- Huntress urged users to patch; at the time, patches were available only for version 22 and later.
- If patching was not immediately possible, Huntress recommended keeping the server inaccessible from the public internet, noting this would not prevent lateral movement within a network.
- Another suggested mitigation was disabling external hardware integration, which could limit functionality where external hardware was in use.
- Huntress said its researchers were still investigating the vulnerability and planned to provide further technical analysis and exploit-detection ideas.
Article Details
- Vulnerability Types
- Remote code execution
- Affected Versions
- PaperCut MF for Windows versions below 22.1.3
- PaperCut NG for Windows versions below 22.1.3
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- If patching is not possible promptly, ensure the server is not publicly accessible from the internet.
- Disable external hardware integration under Options → Advanced → External Hardware Integration.
CVE
People
Adam RiceNamed contributor to the article and response effort.Anthony SmithNamed contributor to the article and response effort.Caleb StewartNamed contributor to the article and response effort.David CarterNamed contributor to the article and response effort.John HammondNamed contributor to the article and response effort.Sharon MartinNamed contributor to the article and response effort.
Vendors
Products
PaperCut MFAs of now, any Windows Papercut MF or NG server below version 22.1.3 is affected. Please follow the patch guidance from Papercut as soon as possible to mitigate this vulnerability. Note that this patch is only availablePaperCut NGUPDATED: PaperCut NG and PaperCut MF are under active exploitation. Huntress reproduced a pre-auth RCE chain and shares urgent patching, exposure, and detection guidance.