Lucene search

PRIOn knowledge basePRION:CVE-2023-42135

HistoryJan 15, 2024 - 2:15 p.m.

Input validation

2024-01-1514:15:00

PRIOn knowledge base

www.prio-n.com

pax devices

paydroid 8.1.0 sagittarius

parameter injection

input validation

physical access

vulnerability

7.5 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

26.3%

JSON

PAX A920Pro/A50 devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow local code execution via parameter injection by bypassing the input validation when flashing a specific partition.

The attacker must have physical USB access to the device in order to exploit this vulnerability.

CPENameOperatorVersion
paydroideq<= 8.1.0sagittarius11.1.5020230614 
paydroideq<= 8.1.0sagittarius11.1.5020230614 

CPE	Name	Operator	Version
	paydroid	eq	<= 8.1.0sagittarius11.1.5020230614
	paydroid	eq	<= 8.1.0sagittarius11.1.5020230614

References

blog.stmcyber.com/pax-pos-cves-2023/

cert.pl/en/posts/2024/01/CVE-2023-4818/

cert.pl/posts/2024/01/CVE-2023-4818/

ppn.paxengine.com/release/development