CVE-2023-26980

Опубликовано: 14 апр. 2023

Источник: nvd

CVSS3: 7

EPSS Низкий

Описание

PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows attackers to bypass the payment software and force the OS to boot directly to Android during the boot process. NOTE: the vendor disputes this because the attack is not feasible: the home launcher will be loaded before any user applications.

Ссылки

https://docs.google.com/document/d/189b1494s8RF8ksaOijKhKb-3B8gj3pLUmgn0dqg-jqs/edit
Mailing List
Third Party Advisory
https://drive.google.com/drive/u/0/folders/14X-XTYhkiaIVBS3zf68VigG4-imbKEuV
Exploit
https://uploads.strikinglycdn.com/files/f1d54bf4-3803-480c-b4d3-0943f7dac76e/A920_EN_20200605.pdf?id=237392
Broken Link
https://docs.google.com/document/d/189b1494s8RF8ksaOijKhKb-3B8gj3pLUmgn0dqg-jqs/edit
Mailing List
Third Party Advisory
https://drive.google.com/drive/u/0/folders/14X-XTYhkiaIVBS3zf68VigG4-imbKEuV
Exploit
https://uploads.strikinglycdn.com/files/f1d54bf4-3803-480c-b4d3-0943f7dac76e/A920_EN_20200605.pdf?id=237392
Broken Link

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:pax:paydroid:8.1:*:*:*:*:*:*:*

cpe:2.3:h:pax:a920_pro:-:*:*:*:*:*:*:*

EPSS

Процентиль: 1%

0.00013

Низкий

7 High

CVSS3

Дефекты

CWE-362

Связанные уязвимости

GHSA-q7gw-cx2f-mh8f