The PaperCut Hive Ricoh embedded application contains a vulnerability (CWE-532) where enabling the "Deep Logging" mode results in administrative credentials being recorded in plain text within log files. An attacker who already has administrative access to the PaperCut Hive management portal can remotely activate deep logging and subsequently extract sensitive device passwords from these logs after an authorized user authenticates. This vulnerability could facilitate lateral movement or unauthorized configuration of physical print devices. The CVSS 4.0 vector indicates network attack vector, low attack complexity, privileged attacker, no user interaction required, and high impact on confidentiality.

The vulnerability exposes administrative credentials in plaintext logs when deep logging is enabled, potentially allowing an attacker with administrative portal access to obtain sensitive device passwords. This could lead to unauthorized configuration changes or lateral movement within the print infrastructure. There is no indication that the vulnerability can be exploited without prior administrative access to the management portal. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to the PaperCut Hive management portal and avoid enabling the "Deep Logging" mode unless absolutely necessary. Monitor for any updates from PaperCut regarding patches or mitigations.