CVE-2023-42137 HIGH

CVE-2023-42137

Vendor Pax Technology
Product POS terminals
Weakness CWE-59
Published January 15, 2024
Last update June 17, 2025

CVSS base score

7.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow for command execution with high privileges by using malicious symlinks. The attacker must have shell access to the device in order to exploit this vulnerability.

Key dates

02Disclosure timeline

January 15, 2024 CVE published
June 17, 2025 Record updated