Product:
PaperCut MF
Summary
A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions, the server may incorrectly process fragmented data chunks, leading to the registration of a truncated badge ID string. This can result in unauthorized session establishment on the device, especially in environments using custom badge-ID post-processing scripts.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.1 | CVE-2026-6180 |
Exploitation
To exploit this vulnerability, an attacker must create conditions that lead to dropped packets and out-of-order sequence counters during badge-swipe data processing. By manipulating the sequence reset notifications, the attacker can cause the server to accept a truncated badge ID string, which may be transformed into a valid ID for a different user, allowing unauthorized access.
Affected Products
- PaperCut MF: Affected by race condition when processing badge-swipe data from HP multifunction devices.
Mitigation
To mitigate this vulnerability, it is recommended to ensure that network conditions are stable and to review the configuration of badge-ID post-processing scripts. Additionally, applying any available patches or updates from PaperCut can help address this issue.