An unsigned-library issue was discovered in ProlinOS through 2.4.161.8859R.
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-347.
Summary
An unsigned-library issue was discovered in ProlinOS through 2.4.161.8859R. This OS requires installed applications and all system binaries to be signed either by the manufacturer or by the Point Of Sale application developer and distributor. The signature is a 2048-byte RSA signature verified in the kernel prior to ELF execution. Shared libraries, however, do not need to be signed, and they are not verified. An attacker may execute a custom binary by compiling it as a shared object and loading it via LD_PRELOAD.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-28045
- 2026-10-03 Alias added: GHSA-63pw-vhjp-v4v8
References
Exploit 1
More PAX Prolinos vulnerabilities
- TI-2020-17072 An issue was discovered in ProlinOS through 2.4.161.8859R. CVSS 3.1HIGH 7.8
- TI-2020-17070 An attacker with physical access to a PAX Point Of Sale device with ProlinOS through… CVSS 3.1MEDIUM 6.8
Sources
- CVE-2020-28045 · CVE Program
- CVE-2020-28045 · NVD
- FIRST EPSS
- GHSA-63pw-vhjp-v4v8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences