PaperCut MF < 25.0.12 / 26.x < 26.0.2 RCE (CVE-2026-14780)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(362593);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/02");

  script_cve_id("CVE-2026-14780");
  script_xref(name:"IAVA", value:"2026-A-1073");

  script_name(english:"PaperCut MF < 25.0.12 / 26.x < 26.0.2 RCE (CVE-2026-14780)");

  script_set_attribute(attribute:"synopsis", value:
"PaperCut MF installed on the remote Windows host is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of PaperCut MF installed on the remote Windows host is prior to 25.0.12, or 26.x prior to 26.0.2. It is,
therefore, affected by a vulnerability:

  - A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient
    sanitization and access restrictions within the embedded execution engine. An authenticated user with
    administrative access to the management interface can supply a malicious script that escapes the runtime
    sandbox. A successful execution enables an attacker to run unauthorized operating system commands with
    administrative privileges on the host operating system. This issue is exploitable only if the optional Print
    and Device Scripting feature is enabled, which Nessus does not check. The feature is disabled by default since
    version 22.1.1. (CVE-2026-14780)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.papercut.com/kb/Main/security-bulletin-sep-2026/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to PaperCut MF version 25.0.12, 26.0.2, or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-14780");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/02");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:papercut:papercut_mf");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("papercut_mf_win_installed.nbin");
  script_require_keys("installed_sw/PaperCut MF", "SMB/Registry/Enumerated", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

# Exploitation requires the optional Print and Device Scripting feature to be enabled, which cannot be checked.
if (report_paranoia < 2) audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'PaperCut MF', 'type': 'app'},
      'check_algorithm': 'default',
      'potential_vulnerability': {
        'missing_config_check': true
      },
      'requires': [
        {'scope': 'target', 'match': {'paranoia': true}}
      ],
      'constraints': [
        {'fixed_version': '25.0.12'},
        {'min_version': '26', 'fixed_version': '26.0.2'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);