CVE-2023-39470

Deeper analysis

CVE-2023-39470 is a remote code execution vulnerability in PaperCut NG that stems from exposure of a dangerous function tied to the print.script.sandboxed setting. The flaw permits an authenticated remote attacker to run arbitrary code on affected installations, with execution occurring in the context of the SYSTEM account. It was originally reported as ZDI-CAN-20965 and carries a CVSS 3.1 base score of 7.2.

An attacker with administrative credentials can exploit the exposed function over the network to achieve full control of the host. No user interaction is required beyond the initial authentication, and the attack does not cross trust boundaries.

Public advisories from PaperCut and the Zero Day Initiative address the issue and are available at the referenced URLs, directing administrators to apply the corresponding security updates or configuration changes.

The associated EPSS score has remained near 0.16 with only minor variation between its current and peak values, indicating no pronounced post-disclosure increase in observed exploitation activity.