The vulnerability arises from an insecure communication channel between the PaperCut NG/MF Embedded application on Konica Minolta devices and the PaperCut server. Because the channel does not encrypt data, an attacker can intercept session information, leading to session hijacking. The primary impact is potential disclosure of sensitive data and the ability to launch phishing attacks against the device user. This weakness corresponds to the under‑used category of clear‑text transmission of sensitive information.

The affected product is PaperCut NG/MF, specifically the embedded application that runs on Konica Minolta multi‑function devices. No specific product version references were supplied, so all versions of the embedded app distributed by PaperCut for Konica Minolta devices are considered vulnerable.

The CVSS score of 3.6 indicates a low security impact under the current scoring methodology, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to be able to observe or intercept communications between the device and its server, which may be possible on the same network or via a compromised server. While the risk surface is limited, the possibility of data theft or user deception warrants careful assessment by customers operating vulnerable devices.