PaperCut Software is warning users of its NG and MF print management solutions that a zero-day vulnerability is being exploited in the wild.
The flaw has yet to be assigned a CVE identifier and no technical details have been shared. The vendor released emergency patches on Friday and urged customers to install them.
PaperCut also recommends disconnecting the application server from the internet and restricting access to trusted IPs.
“We are aware of confirmed customer incidents and are treating this matter with the highest priority. Our investigation is ongoing,” the company said in its advisory.
It’s unclear who is behind the exploitation of the zero-day vulnerability.
PaperCut has shared some indicators of compromise (IoCs), including the name of a suspicious file, pc-app.exe, which indicates that the attackers are delivering malware or other post-exploitation tools.
The company also noted that unexpectedly truncated or deleted server.log files could indicate an intrusion. The removal or modification of log files can suggest that attackers are attempting to cover their tracks.
This is not the first PaperCut NG/MF vulnerability exploited in the wild. CISA’s Known Exploited Vulnerabilities (KEV) catalog includes three flaws, and this latest weakness has not been added.
Two of the security holes included in the KEV list have been exploited in ransomware attacks.
Roughly 1,000 PaperCut instances are currently exposed to the internet, a majority in North America and Europe, according to data from the ShadowServer Foundation.
Related: Recent Citrix NetScaler Vulnerability Exploited in the Wild
Related: Adobe and Nvidia Patch Dozens of Vulnerabilities
Related: CISA Warns of Exploited Gitea Vulnerability
