PaperCut NG/MF up to 24.1.8/25.0.9 toctou

Summaryinfo

A vulnerability, which was classified as critical, has been found in PaperCut NG and MF up to 24.1.8/25.0.9. This impacts an unknown function. This manipulation causes toctou. This vulnerability is tracked as CVE-2026-6180. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in PaperCut NG and MF up to 24.1.8/25.0.9. Affected by this vulnerability is an unknown functionality. The manipulation with an unknown input leads to a toctou vulnerability. The CWE definition for the vulnerability is CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions involving dropped packets and out-of-order sequence counters, the server may incorrectly process fragmented data chunks. If a sequence reset notification fails to reach the server, the server may reject the initial data chunk while erroneously accepting subsequent chunks before a connection reset completes. This leads to the registration of a truncated badge ID string. While this typically results in an authentication failure, the vulnerability is compounded in environments utilizing custom badge-ID post-processing scripts. In such configurations, the truncated string may be transformed into a valid ID belonging to a different user, leading to unauthorized session establishment (Incorrect User Login) on the device.

The advisory is shared at papercut.com. This vulnerability is known as CVE-2026-6180 since 04/13/2026. The exploitation appears to be easy. The attack can be launched remotely. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 313100 (PaperCut NG < 24.1.9 / 25.x < 25.0.10 Race Condition (CVE-2026-6180)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 24.1.9 or 25.0.10 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (313100). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• PaperCut

Name

• MF
• NG

Version

• 24.1.0
• 24.1.1
• 24.1.2
• 24.1.3
• 24.1.4
• 24.1.5
• 24.1.6
• 24.1.7
• 24.1.8
• 25.0.0
• 25.0.1
• 25.0.2
• 25.0.3
• 25.0.4
• 25.0.5
• 25.0.6
• 25.0.7
• 25.0.8
• 25.0.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion