CVE-2024-1223: This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge…

PriorityP423medium4.8CVSS 3.1

AVNACHPRNUINSUCLILAN

EPSS

0.45%

35.5th percentile

This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames, device names and an internal system key. For such an attack to be successful the system must be in a specific runtime state.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
papercut	papercut_mf	< 20.1.10	20.1.10
papercut	papercut_mf	>= 21.0.0 < 21.2.14	21.2.14
papercut	papercut_mf	>= 22.0.0 < 22.1.5	22.1.5
papercut	papercut_mf	>= 23.0.1 < 23.0.7	23.0.7
papercut	papercut_ng	< 20.1.10	20.1.10
papercut	papercut_ng	>= 21.0.0 < 21.2.14	21.2.14
papercut	papercut_ng	>= 22.0.0 < 22.1.5	22.1.5
papercut	papercut_ng	>= 23.0.1 < 23.0.7	23.0.7

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.