""ET EXPLOIT PaperCut MF/NG SetupCompleted Authentication Bypass (CVE-2023-27350)""

SID: 2045130

Revision: 2

Class Type: attempted-admin

Metadata: attack_target Server, created_at 2023_04_21, cve CVE_2023_27350, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, updated_at 2023_05_05, reviewed_at 2023_08_21

Reference:

  • cve

  • 2023-27350

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: $HOME_NET

Destination Port: [9191,$HTTP_PORTS]

Flow: established,to_server

Contents:

  • Value: "GET|20|" Depth: 4

  • Value: "page/SetupCompleted"

Within: 100

PCRE:

Special Options:

  • fast_pattern

source