CVE-2023-42135 MEDIUM

CVE-2023-42135

Vendor Pax Technology
Product A920 Pro
Weakness CWE-74
Published January 15, 2024
Last update June 17, 2025

CVSS base score

6.8/10
Attack vector Physical
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

PAX A920Pro/A50 devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow local code execution via parameter injection by bypassing the input validation when flashing a specific partition. The attacker must have physical USB access to the device in order to exploit this vulnerability.

Key dates

02Disclosure timeline

January 15, 2024 CVE published
June 17, 2025 Record updated