CVE-2023-42136

Summary

PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow the execution of arbitrary commands with system account privilege by shell injection starting with a specific word.

The attacker must have shell access to the device in order to exploit this vulnerability.

Affected Software

Weaknesses

• CWE-77: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

ADP Enrichment

CVE Program Container

Additional References

• https://ppn.paxengine.com/release/development
• https://blog.stmcyber.com/pax-pos-cves-2023/
• https://cert.pl/en/posts/2024/01/CVE-2023-4818/
• https://cert.pl/posts/2024/01/CVE-2023-4818/

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

References

• https://ppn.paxengine.com/release/development
• https://blog.stmcyber.com/pax-pos-cves-2023/
• https://cert.pl/en/posts/2024/01/CVE-2023-4818/
• https://cert.pl/posts/2024/01/CVE-2023-4818/

• ←Previous
• Next→