PT-2022-17939 · Pax · Paydroid+1

Wr3Nchsr · Published 2022-12-16 · Updated 2024-10-28 · CVE-2022-26580

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PAX A930 device with PayDroid versions 7.1.1 Virgo V04.3.26T1 20210419 through 7.1.1 Virgo V04.4.02 20211201

Description The issue allows the execution of specific command injections on selected binaries in the ADB daemon shell service. An attacker must have physical USB access to the device to exploit this.

Recommendations For PAX A930 device with PayDroid version 7.1.1 Virgo V04.3.26T1 20210419, consider restricting physical USB access to minimize the risk of exploitation. For PAX A930 device with PayDroid version 7.1.1 Virgo V04.4.02 20211201, consider restricting physical USB access to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-26580

Affected Products

Pax A930

Paydroid

References · 9

• 🔥❌ https://github.com/wr3nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2022/CVEs/CVE-2022-26580.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-26580 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26580 · Security Note
• https://cyshield.com/e077d6c3-adff-49a1-afc3-71e10140f95c · Note
• https://t.me/cvenotify/77768 · Telegram Post
• https://t.me/cibsecurity/54789 · Telegram Post
• https://t.me/cvenotify/45226 · Telegram Post
• https://wr3nchsr.github.io/pax-paydroid-vulnerabilities-advisory-2022 · Note
• https://t.me/cvenotify/99798 · Telegram Post