CVE-2026-11744
Received Received - Intake

Code Execution via NFC Input in PaperCut Hive for Ricoh Devices

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: PaperCut

Description
An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to the device and a specially crafted NFC card or emulator could exploit this flaw to execute arbitrary code within the context of the application's user interface. This could result in unauthorized actions or information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-11744
EUVD
EUVD-2026-85813

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
papercut ng *
papercut mf *
ricoh hive *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an input validation flaw in the PaperCut Hive embedded application for Ricoh devices. It occurs when the application does not properly sanitize input received during NFC card reading before passing it to the web view interface. A local attacker with physical access and a specially crafted NFC card could exploit this to execute arbitrary code within the application's user interface, potentially leading to unauthorized actions or information disclosure.

Impact Analysis

If exploited, this vulnerability could allow an attacker with physical access to perform unauthorized actions on the device or access sensitive information. Since it affects the application's user interface, the attacker could manipulate the device's functions or view confidential data processed by the application.

Compliance Impact

The vulnerability could lead to unauthorized actions or information disclosure, which may violate data protection requirements under GDPR and HIPAA. Unauthorized code execution in the application's user interface could expose sensitive data or allow unauthorized modifications, potentially resulting in non-compliance with these regulations.

Mitigation Strategies

Update PaperCut Hive embedded application to the latest version as advised in the security bulletin. Disable NFC card reading functionality if not required. Restrict physical access to affected Ricoh devices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11744. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart