CVE-2023-42136 HIGH

CVE-2023-42136

Vendor Pax Technology
Product POS terminals
Weakness CWE-77
Published January 15, 2024
Last update October 10, 2024

CVSS base score

7.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow the execution of arbitrary commands with system account privilege by shell injection starting with a specific word. The attacker must have shell access to the device in order to exploit this vulnerability.

Key dates

02Disclosure timeline

January 15, 2024 CVE published
October 10, 2024 Record updated