PT-2022-17941 · Pax Technology · Paydroid+1

Wr3Nchsr · Published 2022-12-16 · Updated 2024-07-03 · CVE-2022-26582

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PAX A930 device with PayDroid version 7.1.1 Virgo V04.3.26T1 20210419 PAX Technology A930 PayDroid version 7.1.1 Virgo V04.4.02 20211201

Description The issue allows an attacker to gain root access through command injection in the systool client. This can be exploited if the attacker has shell access to the device. The systool server fails to check for dollar signs or backticks in user-supplied commands, leading to arbitrary command execution as root.

Recommendations For PAX A930 device with PayDroid version 7.1.1 Virgo V04.3.26T1 20210419, consider disabling the systool client until a patch is available. For PAX Technology A930 PayDroid version 7.1.1 Virgo V04.4.02 20211201, restrict access to the systool server to minimize the risk of exploitation. As a temporary workaround, avoid using user-supplied commands that contain dollar signs or backticks in the systool server until the issue is resolved.

Exploit

Fix

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

CVE-2022-26582

Affected Products

Pax A930

Paydroid

References · 8

• 🔥❌ https://github.com/wr3nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2022/CVEs/CVE-2022-26582.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-26582 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26582 · Security Note
• https://cyshield.com/e077d6c3-adff-49a1-afc3-71e10140f95c · Note
• https://t.me/cibsecurity/54784 · Telegram Post
• https://t.me/cvenotify/45224 · Telegram Post
• https://wr3nchsr.github.io/pax-paydroid-vulnerabilities-advisory-2022 · Note
• https://t.me/cvenotify/77770 · Telegram Post