An input validation flaw in the PaperCut Hive embedded application for Ricoh devices allows an attacker to inject arbitrary JavaScript into a web view interface. The vulnerability arises because the application does not sanitize NFC card data before displaying it in the UI. This flaw enables the execution of malicious scripts within the application context, potentially leading to unauthorized actions or the disclosure of sensitive information. The weakness is classified as a classic web client‑side injection flaw (CWE‑79).

The flaw affects Ricoh devices running the PaperCut Hive embedded application. No specific product version information is available, so any device that incorporates this version of the embedded app is potentially impacted. Administrators should review device firmware and application versions against the vendor’s security bulletin to determine exposure.

The CVSS score of 3.8 places the vulnerability in the low‑to‑moderate range, and its EPSS score is not currently available. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires a local attacker with physical access to the device and a specially crafted NFC card or NFC emulator. Therefore, the attack is limited to environments where the device is physically accessible, and exploitation probability is relatively low. Nonetheless, any successful exploitation would grant the attacker local code execution within the application’s user interface, posing a moderate risk to device integrity and privacy.