CVE-2023-42136

HIGH

7.8

CVSS Score

Published: January 15, 2024 at 01:28 PM UTC

Updated: June 17, 2026 at 06:23 AM UTC

9 products affected across 1 vendorPaydroidA920 ProA50

Using POS terminals by PAX Technology?

Get instant alerts when new vulnerabilities affect POS terminals - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.5%

SSVC

PoC

Description

PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow the execution of arbitrary commands with system account privilege by shell injection starting with a specific word. The attacker must have shell access to the device in order to exploit this vulnerability.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Paydroid · Paxtechnology

95%

v ≤ 11.1.50_20230614v ≤ 8.1.0_sagittarius_11.1.50_20230614

paxtechnology-a50 (environment) · paxtechnology-a6650 (environment) · paxtechnology-a77 (environment) · paxtechnology-a800 (environment) · paxtechnology-a920 (environment) · paxtechnology-a920-max (environment) · paxtechnology-d190 (environment)

A50 · Paxtechnologydevice

80%

All versions

A6650 · Paxtechnologydevice

80%

All versions

A77 · Paxtechnologydevice

80%

All versions

A800 · Paxtechnologydevice

80%

All versions