Vulnerability Description
PAX A920Pro/A50 devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow local code execution via parameter injection by bypassing the input validation when flashing a specific partition. The attacker must have physical USB access to the device in order to exploit this vulnerability.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Paxtechnology | Paydroid | <= 8.1.0_sagittarius_11.1.50_20230614 |
| Paxtechnology | A920 Pro | - |
| Paxtechnology | A50 | - |
Related Weaknesses (CWE)
References
- https://blog.stmcyber.com/pax-pos-cves-2023/ExploitThird Party Advisory
- https://cert.pl/en/posts/2024/01/CVE-2023-4818/Third Party Advisory
- https://cert.pl/posts/2024/01/CVE-2023-4818/Third Party Advisory
- https://ppn.paxengine.com/release/developmentPermissions Required
- https://blog.stmcyber.com/pax-pos-cves-2023/ExploitThird Party Advisory
- https://cert.pl/en/posts/2024/01/CVE-2023-4818/Third Party Advisory
- https://cert.pl/posts/2024/01/CVE-2023-4818/Third Party Advisory
- https://ppn.paxengine.com/release/developmentPermissions Required
FAQ
What is CVE-2023-42135?
CVE-2023-42135 is a vulnerability with a CVSS score of 6.8 (MEDIUM). PAX A920Pro/A50 devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow local code execution via parameter injection by bypassing the input validation when flashing a specific p...
How severe is CVE-2023-42135?
CVE-2023-42135 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-42135?
Check the references section above for vendor advisories and patch information. Affected products include: Paxtechnology Paydroid, Paxtechnology A920 Pro, Paxtechnology A50.