Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-6180— PaperCut MF: Card truncation on HP readers

Quick assessment

Affected
PaperCut PaperCut NG/MF
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PaperCut MF是澳大利亚PaperCut公司的一套多功能打印机控制软件。 PaperCut MF存在输入验证错误漏洞，该漏洞源于处理特定HP多功能设备的刷卡数据时存在竞争条件，在涉及丢包和乱序序列计数器的特定网络条件下，服务器可能错误处理分片数据块，导致注册截断的徽章ID字符串，在利用自定义徽章ID后处理脚本的环境中，截断的字符串可能被转换为属于其他用户的有效ID，导致设备上建立未经授权的会话。

AI Predicted 8.1 Difficulty: Hard EPSS 0.34% · P27

Affected Version Matrix 2

VendorProduct Version RangeStatus
PaperCut PaperCut NG/MF < 24.1.9 affected
< 25.0.10 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-6180

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PaperCut MF: Card truncation on HP readers
Source: CVE Program / CVE List V5
Vulnerability Description
A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions involving dropped packets and out-of-order sequence counters, the server may incorrectly process fragmented data chunks. If a sequence reset notification fails to reach the server, the server may reject the initial data chunk while erroneously accepting subsequent chunks before a connection reset completes. This leads to the registration of a truncated badge ID string. While this typically results in an authentication failure, the vulnerability is compounded in environments utilizing custom badge-ID post-processing scripts. In such configurations, the truncated string may be transformed into a valid ID belonging to a different user, leading to unauthorized session establishment (Incorrect User Login) on the device.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:P/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5
Vulnerability Title
PaperCut MF 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PaperCut MF是澳大利亚PaperCut公司的一套多功能打印机控制软件。 PaperCut MF存在输入验证错误漏洞，该漏洞源于处理特定HP多功能设备的刷卡数据时存在竞争条件，在涉及丢包和乱序序列计数器的特定网络条件下，服务器可能错误处理分片数据块，导致注册截断的徽章ID字符串，在利用自定义徽章ID后处理脚本的环境中，截断的字符串可能被转换为属于其他用户的有效ID，导致设备上建立未经授权的会话。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
PaperCut PaperCut NG/MF 0 ~ 24.1.9 -

II. Public POCs for CVE-2026-6180

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-6180

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-6180 (1)

Same Patch Batch · PaperCut · 2026-05-05 · 3 CVEs total

CVE-2026-7824 PaperCut Hive (Ricoh): Plain text password in logs
CVE-2026-6418 PaperCut NG/MF: Path Traversal in Shared Account Synchronization

IV. Related Vulnerabilities

Same product: PaperCut NG/MF
Same vendor: PaperCut
Same weakness: CWE-367

V. Comments for CVE-2026-6180

No comments yet

Leave a comment