CVE-2022-26582

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an attacker to gain root access through command injection in systool client. The attacker must have shell access to the device in order to exploit this vulnerability.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Dec 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-265859.8Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.CVE-2022-265886.5A Cross-Site Request Forgery (CSRF) in IceHrm 31.0.0.OS allows attackers to delete arbitrary users or achieve account takeover via the app/s CVE-2022-265896.5A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages.CVE-2022-265917.5FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows unauthenticated attackers to access and download arbitrary files via a crafted GET request.CVE-2022-265928.8Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector::has_real_parent_ref function.CVE-2022-265935.4Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay CVE-2022-265946.1Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow r CVE-2022-265954.3Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when acc CVE-2022-265966.1Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3, a CVE-2022-265976.1Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DX CVE-2022-26607.5Delta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allow CVE-2022-266058.8eZiosuite v2.0.7 contains an authenticated arbitrary file upload via the Avatar upload functionality.