CVE-2026-7824: PaperCut Hive (Ricoh): Plain text password in logs
An issue was discovered in the PaperCut Hive Ricoh embedded application. When the "Deep Logging" (diagnostic) mode is enabled, the application inadvertently records administrative credentials in plain text within the log files.
An attacker with administrative access to the PaperCut Hive management portal could remotely enable deep logging and subsequently retrieve sensitive device passwords from the logs after an authorized user authenticates at the device. This exposure allows for the lateral movement or unauthorized configuration of the physical print hardware.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure “Deep Logging” (diagnostic) mode is not enabled, since when enabled the application records administrative credentials in plain text within log files.
PaperCut Hive (Ricoh) management portal / Ricoh embedded application Deep Logging (diagnostic) mode = disable
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7824?
CVE-2026-7824 is categorized as a medium severity vulnerability due to the exposure of administrative credentials.
How do I fix CVE-2026-7824?
To resolve CVE-2026-7824, disable the "Deep Logging" mode to prevent the logging of administrative passwords in plain text.
What are the risks associated with CVE-2026-7824?
The risks of CVE-2026-7824 include unauthorized access to administrative accounts if an attacker gains access to the log files.
Which version of PaperCut is affected by CVE-2026-7824?
CVE-2026-7824 affects the PaperCut Hive (Ricoh) embedded application when the Deep Logging mode is enabled.
Is CVE-2026-7824 being actively exploited?
There are currently no public reports indicating that CVE-2026-7824 is being actively exploited, but it poses a security risk that should be addressed.