The PaperCut NG/MF embedded application on Konica Minolta multi-function devices transmits sensitive session information over an insecure channel, leading to potential session hijacking (CWE-319). This vulnerability arises from cleartext transmission of data between the embedded application and the server, which could be intercepted by an attacker. The CVSS 4.0 score is 3.6, reflecting low severity with attack vector being adjacent network and requiring high attack complexity. No official patch or vendor advisory detailing remediation is provided in the available data.

The vulnerability could allow an attacker with access to the adjacent network to intercept sensitive session information, potentially enabling session hijacking. This could lead to unauthorized access to user sessions or data leakage. However, the low CVSS score and lack of known exploits indicate limited immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit network exposure of affected devices and monitor for suspicious activity related to session hijacking attempts. Avoid transmitting sensitive information over insecure channels where possible.