Medium · 6.7 CVE-2023-42133 EUVD-2023-46592GHSA-xr7h-8r7p-xpv9

PAX Android based POS devices allow for escalation of privilege via improperly configured scripts. An attacker must have shell access with …

Published Oct 11, 2024 · Updated Oct 11, 2024 · Assigned by CERT-PL

Vendor: PAX Technology Product: POS terminals

Description

PAX Android based POS devices allow for escalation of privilege via improperly configured scripts.

An attacker must have shell access with system account privileges in order to exploit this vulnerability.
A patch addressing this issue was included in firmware version PayDroid_8.1.0_Sagittarius_V11.1.61_20240226.

Affected products

Vendor	Product	Affected	Fixed
PAX	POS terminals	< 11.1.61_20240226	11.1.61_20240226

References

https://ppn.paxengine.com/release/development? vendor-advisory
https://blog.stmcyber.com/pax-pos-cves-2023/ technical-description
https://cert.pl/en/posts/2024/10/CVE-2023-42133 third-party-advisory
https://cert.pl/posts/2024/10/CVE-2023-42133 third-party-advisory