CVE-2023-42134

CVE-2023-42134 and CVE-2023-42135 affect PAX Android PoS devices (e.g., A920Pro/A50) and enable local code execution as root via kernel parameter injection in fastboot on affected PayDroid builds before 20230614; CVE-2023-42136 and CVE-2023-42137 enable privilege escalation via shell injection in...

PT-2024-1567 · Pax · Paydroid

Name of the Vulnerable Software and Affected Versions: PAX A920Pro/A50 devices with PayDroid versions 8.1.0 Sagittarius V11.1.50 20230614 or earlier Description: The issue exists due to insufficient input validation in the PayDroid operating system, allowing an attacker to execute arbitrary code...

PAX Technology Android based POS Backlink Vulnerability

PAX Technology Android based POS is a series of Android mobile payment terminals from China-based PAX Global PAX Technology. PAX Technology Android based POS PayDroid8.1.0SagittariusV11.1.5020230614 and prior versions suffer from a backlink vulnerability that originates from allowing commands to ...

PAX Technology A920 Security Vulnerability

PAX Technology A920 is an Android mobile payment terminal from PAX Technology. A security vulnerability exists in PAX Technology A920 PayDroid8.1.0SagittariusV11.1.4520230314 and prior versions, which originates from the ability to bypass input validation when refreshing a specific partition, and...

PT-2024-1564 · Pax · Pax A920

Name of the Vulnerable Software and Affected Versions: PAX A920 device affected versions not specified Description: The issue is related to a bug in the version check of the PAX A920 device's bootloader, allowing it to be downgraded. The device correctly checks the signature and only allows...

PT-2024-1563 · Pax · Paydroid

Name of the Vulnerable Software and Affected Versions: PAX Android based POS devices with PayDroid versions 8.1.0 Sagittarius V11.1.50 20230614 or earlier Description: The issue exists due to insufficient input validation in the PayDroid operating system, allowing an attacker to execute arbitrary...

CVE-2023-27199

PAX Technology A930 PayDroid7.1.1VirgoV04.5.0220220722 allows attackers to compile a malicious shared library and use LDPRELOAD to bypass authorization checks...

CVE-2023-27197

PAX A930 device with PayDroid7.1.1VirgoV04.5.0220220722 can allow an attacker to gain root access by running a crafted binary leveraging an exported function from a shared library. The attacker must have shell access to the device in order to exploit this vulnerability...

CVE-2023-27197

PAX A930 device with PayDroid7.1.1VirgoV04.5.0220220722 can allow an attacker to gain root access by running a crafted binary leveraging an exported function from a shared library. The attacker must have shell access to the device in order to exploit this vulnerability...

CVE-2023-27199

PAX Technology A930 PayDroid7.1.1VirgoV04.5.0220220722 allows attackers to compile a malicious shared library and use LDPRELOAD to bypass authorization checks...

CVE-2023-27198

PAX A930 device with PayDroid7.1.1VirgoV04.5.0220220722 can allow the execution of arbitrary commands by using the exec service and including a specific word in the command to be executed. The attacker must have physical USB access to the device in order to exploit this vulnerability...

CVE-2023-27197

PAX A930 device with PayDroid7.1.1VirgoV04.5.0220220722 can allow an attacker to gain root access by running a crafted binary leveraging an exported function from a shared library. The attacker must have shell access to the device in order to exploit this vulnerability...

PT-2023-21000 · Pax Technology · Pax Technology A930 Paydroid

Name of the Vulnerable Software and Affected Versions: PAX Technology A930 PayDroid version 7.1.1 Virgo V04.5.02 20220722 Description: The issue allows attackers to compile a malicious shared library and use LD PRELOAD to bypass authorization checks. This can be achieved by utilizing the LD PRELO...

PT-2023-20999 · Pax · Pax A930 +1

Name of the Vulnerable Software and Affected Versions: PAX A930 device with PayDroid version 7.1.1 Virgo V04.5.02 20220722 Description: The issue allows the execution of arbitrary commands by using the exec service and including a specific word in the command to be executed. The attacker must hav...

CVE-2023-27198

PAX A930 device with PayDroid7.1.1VirgoV04.5.0220220722 can allow the execution of arbitrary commands by using the exec service and including a specific word in the command to be executed. The attacker must have physical USB access to the device in order to exploit this vulnerability...

CVE-2023-27197

PAX A930 device with PayDroid7.1.1VirgoV04.5.0220220722 can allow an attacker to gain root access by running a crafted binary leveraging an exported function from a shared library. The attacker must have shell access to the device in order to exploit this vulnerability...

PAX Technology A930 安全漏洞

The PAX Technology A930 is an Android mobile payment terminal from China-based PAX Technology. A security vulnerability exists in the PAX Technology A930 PayDroid7.1.1VirgoV04.5.0220220722 version, which originated from a vulnerability that allows an attacker to gain root access by running a...

CVE-2023-27199

The CVE-2023-27199 entry concerns PAX Technology A930 PayDroid_7.1.1_Virgo_V04.5.02_20220722. The issue is that an attacker can compile a malicious shared library and abuse the LD_PRELOAD mechanism to bypass authorization checks. The connected documents consistently describe this bypass of author...

PAX Technology A930 操作系统命令注入漏洞

PAX Technology A930 is an Android mobile payment terminal from PAX Technology China. A security vulnerability exists in the PAX Technology A930 PayDroid7.1.1VirgoV04.5.0220220722 version, which originates from allowing arbitrary commands to be executed by using the exec service and including...

CVE-2023-27197

CVE-2023-27197 affects PAX A930 with PayDroid 7.1.1 Virgo V04.5.02 20220722. The flaw lets an attacker with shell access gain root by running a crafted binary that uses an exported function from a shared library. Affected component/root cause: exploited via a shared-library export; impact is root...