CVE-2024-1654 is a high severity (CVSS 7.2) flaw in PaperCut NG/MF. An attacker who already has authenticated admin access can carry out unauthorized write operations that may lead to remote code execution. PaperCut's March 2024 bulletin lists fixed versions 23.0.7 or later, 22.1.5, 21.2.14 and 20.1.10.
What's affected
PaperCut's Security Bulletin for March 2024, last updated 14 March 2024 in the version we read, covers a set of issues fixed in release 23.0.7. For this CVE the bulletin describes unauthorized write operations that need an attacker with authenticated access to the admin console, who also needs information only available to admin users. It carries the Trend Micro Zero Day Initiative label ZDI-CAN-22328.
The fixed versions in the bulletin are 23.0.7 or later, 22.1.5, 21.2.14 and 20.1.10. You must apply the upgrade to Application Servers and Site Servers. The bulletin rates the issue 7.2 with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, which matches the NVD score of 7.2 (high). The weakness is CWE-183 (permissive list of allowed inputs).
How to check if you're exposed
Check the version on the admin console home page, or the About page. Compare it with the fixed versions in the bulletin: 23.0.7 or later, 22.1.5, 21.2.14, 20.1.10. Anything older in the same branch is affected.
Also check Site Servers, which need the upgrade as well. If you use the Job Ticketing module, which the bulletin treats in its other entries, confirm it has automatically updated as the bulletin describes. Review who holds admin rights, because this flaw needs them.
What to do now
- Upgrade Application Servers and Site Servers to 23.0.7 or later, or to 22.1.5, 21.2.14 or 20.1.10 on your branch.
- Read the full bulletin, since the same release fixes other issues that need less privilege.
- Reduce the number of admin accounts and enforce strong authentication for them.
- Restrict network access to the admin console to trusted networks.
- Audit recent admin activity for unexpected changes.
Why it matters
This CVE is a second step issue. It needs admin access first, so on its own it is rated 7.2 rather than critical. In a real incident, an attacker with a stolen admin password could use a flaw like this to move from managing print settings to running code on the server.
Print management servers often hold wide access, including directory integration and user data, so they deserve the same patching as other servers. The record's KEV flag is false for this CVE. The bulletin's discussion of other CVEs is separate. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this need admin credentials?
Yes. The bulletin says the attacker must already have authenticated access to the admin console and know information only available to admin users.
Sources
Last reviewed: 19 October 2026.
