Vulnerability · Published Jan 15, 2024 · Assigned by CERT-PL
CVE-2023-42134
Medium 6.8
In plain English
A medium-severity security flaw in POS terminals from PAX Technology. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.6%top 53.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.45_20230314 or earlier can allow the signed partition overwrite and subsequently local code execution via hidden command. The attacker must have physical USB access to the device in order to exploit this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PAX Technology | POS terminals | 0 – through 11.1.45_20230314 |
Weakness: CWE-912 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://ppn.paxengine.com/release/development vendor-advisory
- https://blog.stmcyber.com/pax-pos-cves-2023/ technical-description
- https://cert.pl/en/posts/2024/01/CVE-2023-4818/ third-party-advisory
- https://cert.pl/posts/2024/01/CVE-2023-4818/ third-party-advisory