CVE-2023-42137

HIGH

PAX PayDroid < 8.1.0_sagittarius_11.1.50_20230614 - Authenticated Privilege Escalation via Symlink Attack

Title source: llm
STIX 2.1

Description

PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow for command execution with high privileges by using malicious symlinks. The attacker must have shell access to the device in order to exploit this vulnerability.

References (4)

Core 4
Core References
Permissions Required vendor-advisory
https://ppn.paxengine.com/release/development
Exploit, Third Party Advisory technical-description
https://blog.stmcyber.com/pax-pos-cves-2023/
Third Party Advisory third-party-advisory
https://cert.pl/en/posts/2024/01/CVE-2023-4818/
Third Party Advisory third-party-advisory
https://cert.pl/posts/2024/01/CVE-2023-4818/

Scores

CVSS v3 7.8
EPSS 0.0047
EPSS Percentile 36.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-59
Status published
Products (1)
paxtechnology/paydroid < 8.1.0_sagittarius_11.1.50_20230614
Published Jan 15, 2024
Tracked Since Feb 18, 2026