CVE-2023-42135

PAX A920Pro/A50 devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow local code execution via parameter injection by bypassing the input validation when flashing a specific partition. The attacker must have physical USB access to the device in order to exploit this vulnerability.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://blog.stmcyber.com/pax-pos-cves-2023/	Exploit Third Party Advisory
https://cert.pl/en/posts/2024/01/CVE-2023-4818/	Third Party Advisory
https://cert.pl/posts/2024/01/CVE-2023-4818/	Third Party Advisory
https://ppn.paxengine.com/release/development	Permissions Required

Configurations

Configuration 1 (hide)

AND

cpe:2.3:h:paxtechnology:a920_pro:-:*:*:*:*:*:*:*

cpe:2.3:o:paxtechnology:paydroid:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:h:paxtechnology:a50:-:*:*:*:*:*:*:*

cpe:2.3:o:paxtechnology:paydroid:*:*:*:*:*:*:*:*

History

10 Oct 2024, 16:15

Type	Values Removed	Values Added
CWE	~~CWE-20~~

19 Jan 2024, 15:47

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-15 14:15

Updated : 2024-10-10 16:15

NVD link : CVE-2023-42135

Mitre link : CVE-2023-42135

CVE.ORG link : CVE-2023-42135

JSON object : View

Products Affected

paxtechnology

paydroid
a50
a920_pro

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

{"id": "CVE-2023-42135", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}, {"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "published": "2024-01-15T14:15:24.413", "references": [{"url": "https://blog.stmcyber.com/pax-pos-cves-2023/", "tags": ["Exploit", "Third Party Advisory"], "source": "cvd@cert.pl"}, {"url": "https://cert.pl/en/posts/2024/01/CVE-2023-4818/", "tags": ["Third Party Advisory"], "source": "cvd@cert.pl"}, {"url": "https://cert.pl/posts/2024/01/CVE-2023-4818/", "tags": ["Third Party Advisory"], "source": "cvd@cert.pl"}, {"url": "https://ppn.paxengine.com/release/development", "tags": ["Permissions Required"], "source": "cvd@cert.pl"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-74"}]}, {"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-74"}]}], "descriptions": [{"lang": "en", "value": "PAX A920Pro/A50 devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow local code execution via parameter injection by bypassing the input validation when flashing a specific partition. \n\n\n\n\n\nThe attacker must have physical USB access to the device in order to exploit this vulnerability."}, {"lang": "es", "value": "Los dispositivos PAX A920Pro/A50 con PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 o anterior pueden permitir la ejecuci\u00f3n de c\u00f3digo local mediante inyecci\u00f3n de par\u00e1metros al omitir la validaci\u00f3n de entrada al actualizar una partici\u00f3n espec\u00edfica. El atacante debe tener acceso USB f\u00edsico al dispositivo para poder aprovechar esta vulnerabilidad."}], "lastModified": "2024-10-10T16:15:05.690", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:paxtechnology:a920_pro:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FF80918D-3453-4F42-A8A0-DA993C398394"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:paxtechnology:paydroid:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "970DD715-DA0A-4E3B-A51A-4B04EEC55CC8", "versionEndIncluding": "8.1.0_sagittarius_11.1.50_20230614"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:paxtechnology:a50:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DFCCCD93-0374-4AE1-8986-E0997B53A51C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:paxtechnology:paydroid:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "970DD715-DA0A-4E3B-A51A-4B04EEC55CC8", "versionEndIncluding": "8.1.0_sagittarius_11.1.50_20230614"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cvd@cert.pl"}