CVE-2023-42133
- State
- Published
- Severity
- 6.7 Medium
- Published
- Oct 11, 2024
- Updated
- Oct 11, 2024
- Reserved
- Sep 7, 2023
Description
PAX Android based POS devices allow for escalation of privilege via improperly configured scripts.
An attacker must have shell access with system account privileges in order to exploit this vulnerability. A patch addressing this issue was included in firmware version PayDroid_8.1.0_Sagittarius_V11.1.61_20240226.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.7 Medium | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | CERT-PL |
Weaknesses
- CWE-276 Incorrect Default Permissions
Affected Products
| Product | Versions |
|---|---|
POS terminalsPAX |
|
References
- https://ppn.paxengine.com/release/development?vendor-advisory
- https://blog.stmcyber.com/pax-pos-cves-2023/technical-description
- https://cert.pl/en/posts/2024/10/CVE-2023-42133third-party-advisory
- https://cert.pl/posts/2024/10/CVE-2023-42133third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.