CVE-2024-1654
Papercut Mf ≤ 20.1.10
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-1654 is a high-severity Permissive List of Allowed Inputs (CWE-183) vulnerability in Papercut Papercut Mf. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked in the top 30% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-1654 is an improper access control issue that permits unauthorized write operations, potentially resulting in remote code execution. The flaw affects PaperCut print management software, as indicated by the vendor's March 2024 security bulletin.
An authenticated administrator who also possesses an internal system identifier and details of another valid user account can exploit the weakness over the network to achieve code execution with high impact to confidentiality, integrity, and availability. The CVSS 7.2 score reflects these requirements for high privileges and specific knowledge, limiting the attack to insiders or compromised admin sessions.
The referenced PaperCut security bulletin addresses the issue and provides mitigation guidance, including available patches and configuration recommendations for affected installations.
EPSS for the CVE rose from a low baseline to a peak of 0.0962 in December 2025 before receding to the current value of 0.0415, indicating a period of increased exploitation interest after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-17389
Vulnerability Data
This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.5.2V4.4.2
Mitigating Controls (NIST 800-53 r5) AI
Strict validity checks on inputs directly stop overly permissive allow lists from being used as the protection mechanism.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require rigorous allow-list design and testing that prevents permissive input validation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Application security requirements can mandate strict, minimal allow-lists and input validation rules that prevent overly permissive lists.
A.8.27 mandates security-by-design principles (least privilege, default-deny, distrust-external-input, secure session control, data validation/sanitization, assume-breach) that reach many but not all permissive-allowlist cases; a bounded remainder (e.g. custom business-logic allowlists whose enumerated safe values are chosen incorrectly) can still be introduced and exploited.
Secure coding standards enforce rigorous input validation and reject unsafe values, mitigating permissive allow-list weaknesses.
Security testing can detect overly broad allow-lists, but does not inherently prevent their creation.