Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2023-42135

PAX A920Pro/A50 devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow local code execution via parameter injection by bypassing the input validation when f

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERT-PL

Description

PAX A920Pro/A50 devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow local code execution via parameter injection by bypassing the input validation when flashing a specific partition. The attacker must have physical USB access to the device in order to exploit this vulnerability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PAX Technology A920 Pro

Default version status: unaffected

  • 0 to ≤ 11.1.50_20230614affected

PAX Technology A50

Default version status: unaffected

  • 0 to ≤ 11.1.50_20230614affected

References