CVE-2023-42137
- State
- Published
- Severity
- 7.8 High
- Published
- Jan 15, 2024
- Updated
- Jun 17, 2025
- Reserved
- Sep 7, 2023
Description
PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow for command execution with high privileges by using malicious symlinks.
The attacker must have shell access to the device in order to exploit this vulnerability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.8 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CERT-PL |
Weaknesses
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected Products
| Product | Versions |
|---|---|
POS terminalsPAX Technology |
|
References
- https://ppn.paxengine.com/release/developmentvendor-advisory
- https://blog.stmcyber.com/pax-pos-cves-2023/technical-description
- https://cert.pl/en/posts/2024/01/CVE-2023-4818/third-party-advisory
- https://cert.pl/posts/2024/01/CVE-2023-4818/third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.