Injection in PAX Technology A920
Priority LOW 34CWE-74Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
PAX A920 device allows to downgrade bootloader due to a bug in its version check. The signature is correctly checked and only bootloader signed by PAX can be used. The attacker must have physical USB access to the device in order to exploit this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00663 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed A920 (PAX Technology): A920_AP_Boot_Release_V5.14
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PAX Technology | A920 | before A920_AP_Boot_Release_V5.14 | A920_AP_Boot_Release_V5.14 | Patch available | CNA |
- A920 VendorPAX Technology Affected before A920_AP_Boot_Release_V5.14 Fixed in A920_AP_Boot_Release_V5.14 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:paxtechnology:paydroid:7.1.2_aquarius_11.1.50_20230614:*:*:*:*:*:*:* | 7.1.2_aquarius_11.1.50_20230614 | Vulnerable | PAX Technology |
| cpe:2.3:h:paxtechnology:a920:-:*:*:*:*:*:*:* | not specified by NVD | Running on | PAX Technology |
- cpe:2.3:o:paxtechnology:paydroid:7.1.2_aquarius_11.1.50_20230614:*:*:*:*:*:*:* Versions 7.1.2_aquarius_11.1.50_20230614 Vulnerable ·PAX Technology
- cpe:2.3:h:paxtechnology:a920:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·PAX Technology
Remediation
- Fix · CNA A920 (PAX Technology) Fixed in A920_AP_Boot_Release_V5.14
Timeline
- 2026-10-02 Threatist record created from CVE-2023-4818
- 2026-10-03 Alias added: GHSA-hpqw-739g-5cvm
- 2026-10-06 EPSS moved to the 50th–90th percentile
References
More PAX Technology Paydroid vulnerabilities
- TI-2023-22504 Command injection in PAX Technology POS terminals CVSS 3.1HIGH 7.8
- TI-2023-22505 Link following in PAX Technology POS terminals CVSS 3.1HIGH 7.8
- TI-2023-22503 Injection in PAX Technology A920 Pro CVSS 3.1MEDIUM 6.8
- TI-2023-22502 PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.45_20230314 or… CVSS 3.1MEDIUM 6.8
- TI-2022-09885 PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an attacker to… CVSS 3.1HIGH 7.8
- TI-2022-09883 PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow the execution of… CVSS 3.1MEDIUM 6.8
Sources
- CVE-2023-4818 · CVE Program
- CVE-2023-4818 · NVD
- FIRST EPSS
- GHSA-hpqw-739g-5cvm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences