VulnerabilityDeferred

CVE-2023-42133

PAX Android based POS devices allow for escalation of privilege via improperly configured scripts.

MEDIUM 6.7EPSS 0.23%

Does this matter?

Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own.

Description

PAX Android based POS devices allow for escalation of privilege via improperly configured scripts. An attacker must have shell access with system account privileges in order to exploit this vulnerability. A patch addressing this issue was included in firmware version PayDroid_8.1.0_Sagittarius_V11.1.61_20240226.

CVSS 3.1: 6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.23% probability · 14th percentile
CISA KEV: Not listed
Weakness: CWE-276
Source: cvd@cert.pl

References

https://blog.stmcyber.com/pax-pos-cves-2023/
https://cert.pl/en/posts/2024/10/CVE-2023-42133
https://cert.pl/posts/2024/10/CVE-2023-42133
https://ppn.paxengine.com/release/development?

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.