PT-2024-13032 · Pax · Pax Android

Adam Klis + 1 · Published 2024-01-17 · Updated 2024-10-15 · CVE-2023-42133

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PAX Android based POS devices versions prior to PayDroid 8.1.0 Sagittarius V11.1.61 20240226

Description The issue allows for escalation of privilege via improperly configured scripts. An attacker must have shell access with system account privileges in order to exploit this issue.

Recommendations For versions prior to PayDroid 8.1.0 Sagittarius V11.1.61 20240226, update the firmware to version PayDroid 8.1.0 Sagittarius V11.1.61 20240226 or later to resolve the issue.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2023-42133

Affected Products

Pax Android

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2023-42133 · Security Note
• https://ppn.paxengine.com/release/development? · Vendor Advisory
• https://blog.stmcyber.com/pax-pos-cves-2023 · Note
• https://twitter.com/transilienceai/status/1845874001807315429 · Twitter Post
• https://twitter.com/androidmalware2/status/1751920882203685176 · Twitter Post
• https://twitter.com/transilienceai/status/1845873989157376473 · Twitter Post
• https://twitter.com/Treadstone71LLC/status/1752291499314663675 · Twitter Post
• https://twitter.com/transilienceai/status/1845874032090223034 · Twitter Post
• https://twitter.com/transilienceai/status/1845874019725463584 · Twitter Post
• https://t.me/true_secator/5303 · Telegram Post
• https://t.me/echeloneyes/2372 · Telegram Post
• https://cert.pl/en/posts/2024/10/CVE-2023-42133 · Note
• https://cert.pl/posts/2024/10/CVE-2023-42133 · Note
• https://twitter.com/transilienceai/status/1845874009956884726 · Twitter Post