CVE-2023-42134

6.8 mediumEPSS 0.6%

Medium (6.8) in paxtechnology paydroid. EPSS 0.6% chance of exploitation in the next 30 days.

PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.45_20230314 or earlier can allow the signed partition overwrite and subsequently local code execution via hidden command. The attacker must have physical USB access to the device in order to exploit this vulnerability.

Severity

CVSS 3.1

6.8 medium

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-912
Published: 2024-01-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

paxtechnology:paydroid

References

https://blog.stmcyber.com/pax-pos-cves-2023/
https://cert.pl/en/posts/2024/01/CVE-2023-4818/
https://cert.pl/posts/2024/01/CVE-2023-4818/
https://ppn.paxengine.com/release/development
https://blog.stmcyber.com/pax-pos-cves-2023/

Check your stack JSON