important · Physical — Printers
A crafted NFC card can execute JavaScript in PaperCut Hive's embedded Ricoh printer interface.
Affects
PaperCut Hive Embedded Application for Ricoh, the cloud print-management client embedded in Ricoh multifunction printers.
The demonstrated boundary ends at JavaScript inside the embedded browser sandbox; the vendor does not identify reachable browser bridges, data or unauthorized actions.
Detail and 1 source
PaperCut identifies version 2.3.0 as the corrected release.
Chain to watch
Present crafted NFC data to an affected PaperCut Hive application on a representative Ricoh device.→↓Trace the injected script's access to browser bridges, application data and printer operations.→↓What capability exists beyond sandboxed JavaScript execution.
Unverified chainInspect the 2.3.0 change or instrument an affected device's WebView bridge calls.