CVE-2023-42133

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

PAX Android based POS devices allow for escalation of privilege via improperly configured scripts.

An attacker must have shell access with system account privileges in order to exploit this vulnerability. A patch addressing this issue was included in firmware version PayDroid_8.1.0_Sagittarius_V11.1.61_20240226.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
PAX	POS terminals	< 11.1.61_20240226
paxtechnology	paydroid	< 11.1.61_20240226

References

Timeline

Published: Oct 11, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-421346.8PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.45_20230314 or earlier can allow the signed partition overwrite and subs CVE-2023-421356.8PAX A920Pro/A50 devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow local code execution via parameter injection CVE-2023-421367.8PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow the execution of arbitrary commands wit CVE-2023-421377.8PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow for command execution with high privile CVE-2023-421387.8Out-of-bounds read vulnerability exists in KV STUDIO Ver. 11.62 and earlier and KV REPLAY VIEWER Ver. 2.62 and earlier. If this vulnerabilit CVE-2023-42149.8The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the CVE-2023-421435.4Missing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device CVE-2023-421445.5Cleartext Transmission during initial setup in Shelly TRV 20220811-15234 v.2.1.8 allows a local attacker to obtain the Wi-Fi password.CVE-2023-421477.5An issue in CloudExplorer Lite 1.3.1 allows an attacker to obtain sensitive information via the login key component.CVE-2023-42157.5Advantech WebAccess version 9.1.3 contains an exposure of sensitive information to an unauthorized actor vulnerability that could leak user CVE-2023-42162.7The Orders Tracking for WooCommerce WordPress plugin before 1.2.6 doesn't validate the file_url parameter when importing a CSV file, allowin CVE-2023-42175.3A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the