An input validation vulnerability (CWE-79) exists in PaperCut Hive embedded application for Ricoh devices. The application does not properly neutralize input received during the NFC card reading process before passing it to the web view interface. This allows a local attacker with physical access and a crafted NFC card or emulator to execute arbitrary code in the context of the application's UI, potentially causing unauthorized actions or information disclosure. The affected versions are >=2.0.0 and <2.3.0. The CVSS 4.0 vector indicates local attack vector with low complexity, no privileges or user interaction required, but high impact on confidentiality and security scope changes. No known exploits in the wild or vendor patches are currently documented.

The vulnerability enables arbitrary code execution within the application's user interface context by a local attacker with physical access to the device and a specially crafted NFC card or emulator. This could result in unauthorized actions or disclosure of sensitive information within the application. The impact is limited by the requirement for physical access and local attack vector, reflected in the low CVSS score of 3.8.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict physical access to affected devices and avoid using untrusted NFC cards or emulators with the PaperCut Hive application.