Описание
PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an attacker to gain root access through command injection in systool client. The attacker must have shell access to the device in order to exploit this vulnerability.
Ссылки
- Third Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1
Одновременно
cpe:2.3:o:paxtechnology:paydroid:7.1.1_virgo_v04.3.26t1_20210419:*:*:*:*:*:*:*
cpe:2.3:h:paxtechnology:a930:-:*:*:*:*:*:*:*
EPSS
Процентиль: 67%
0.00532
Низкий
7.8 High
CVSS3
Дефекты
CWE-20
CWE-20
Связанные уязвимости
CVSS3: 7.8
github
около 3 лет назад
The systool_server in PAX Technology A930 PayDroid 7.1.1 Virgo V04.4.02 20211201 fails to check for dollar signs or backticks in user supplied commands, leading to to arbitrary command execution as root.
EPSS
Процентиль: 67%
0.00532
Низкий
7.8 High
CVSS3
Дефекты
CWE-20
CWE-20