CVE-2023-42137

HIGH

7.8

Descripcion

PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow for command execution with high privileges by using malicious symlinks. The attacker must have shell access to the device in order to exploit this vulnerability.

Detalles CVE

Puntuacion CVSS v3.17.8

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueLOCAL

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado1/15/2024

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

paxtechnology:a50paxtechnology:a6650paxtechnology:a77paxtechnology:a800paxtechnology:a920paxtechnology:a920_maxpaxtechnology:a920_propaxtechnology:d190paxtechnology:paydroid

Debilidades (CWE)

CWE-59CWE-59

Referencias

https://blog.stmcyber.com/pax-pos-cves-2023/(cvd@cert.pl)

https://cert.pl/en/posts/2024/01/CVE-2023-4818/(cvd@cert.pl)

https://cert.pl/posts/2024/01/CVE-2023-4818/(cvd@cert.pl)

https://ppn.paxengine.com/release/development(cvd@cert.pl)

https://blog.stmcyber.com/pax-pos-cves-2023/(af854a3a-2127-422b-91ae-364da2661108)

https://cert.pl/en/posts/2024/01/CVE-2023-4818/(af854a3a-2127-422b-91ae-364da2661108)

https://cert.pl/posts/2024/01/CVE-2023-4818/(af854a3a-2127-422b-91ae-364da2661108)

https://ppn.paxengine.com/release/development(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.