CVE-2023-42133

Published: Oct 11, 2024Modified: Jun 17, 2026Deferred

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: cvd@cert.pl (Secondary)

Description

PAX Android based POS devices allow for escalation of privilege via improperly configured scripts. An attacker must have shell access with system account privileges in order to exploit this vulnerability. A patch addressing this issue was included in firmware version PayDroid_8.1.0_Sagittarius_V11.1.61_20240226.

Related CWEs

CWE-276

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

References (4)

https://blog.stmcyber.com/pax-pos-cves-2023/

Source: cvd@cert.pl

https://cert.pl/en/posts/2024/10/CVE-2023-42133

Source: cvd@cert.pl

https://cert.pl/posts/2024/10/CVE-2023-42133

Source: cvd@cert.pl

https://ppn.paxengine.com/release/development?

Source: cvd@cert.pl

Timeline

No history available yet.