PT-2023-20999 · Pax · Pax A930+1

Saif Aziz + 1 · Publicado 2023-07-05 · Atualizado 2024-07-03 · CVE-2023-27198

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PAX A930 device with PayDroid version 7.1.1 Virgo V04.5.02 20220722

Description The issue allows the execution of arbitrary commands by using the exec service and including a specific word in the command to be executed. The attacker must have physical USB access to the device in order to exploit this.

Recommendations For PAX A930 device with PayDroid version 7.1.1 Virgo V04.5.02 20220722, consider restricting physical USB access to the device to minimize the risk of exploitation. As a temporary workaround, consider disabling the exec service until a patch is available.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2023-27198

Produtos afetados

Pax A930

Paydroid

Referências · 8

• 🔥❌ https://github.com/wr3nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2023/CVEs/CVE-2023-27198.md · Exploit, Deleted
• https://wr3nchsr.github.io/pax-paydroid-vulnerabilities-advisory-2023 · Nota
• https://osv.dev/vulnerability/CVE-2023-27198 · Aviso do Fabricante
• https://t.me/cibsecurity/66020 · Publicação no Telegram
• https://t.me/cvenotify/77773 · Publicação no Telegram
• https://t.me/cvenotify/53692 · Publicação no Telegram
• https://t.me/cvenotify/54135 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-27198 · Nota de Segurança