PT-2023-20999 · Pax · Pax A930+1

Saif Aziz + 1 · Published 2023-07-05 · Updated 2024-07-03 · CVE-2023-27198

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PAX A930 device with PayDroid version 7.1.1 Virgo V04.5.02 20220722

Description The issue allows the execution of arbitrary commands by using the exec service and including a specific word in the command to be executed. The attacker must have physical USB access to the device in order to exploit this.

Recommendations For PAX A930 device with PayDroid version 7.1.1 Virgo V04.5.02 20220722, consider restricting physical USB access to the device to minimize the risk of exploitation. As a temporary workaround, consider disabling the exec service until a patch is available.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-27198

Affected Products

Pax A930

Paydroid

References · 8

• 🔥❌ https://github.com/wr3nchsr/PAX-Paydroid-Advisories/blob/master/advisories/2023/CVEs/CVE-2023-27198.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2023-27198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27198 · Security Note
• https://wr3nchsr.github.io/pax-paydroid-vulnerabilities-advisory-2023 · Note
• https://t.me/cibsecurity/66020 · Telegram Post
• https://t.me/cvenotify/77773 · Telegram Post
• https://t.me/cvenotify/53692 · Telegram Post
• https://t.me/cvenotify/54135 · Telegram Post