Cyber Resilience

CVE-2023-42137

HighPublic PoC

Published: 15 January 2024

Published
15 January 2024
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0039 60.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-42137 is a high-severity Link Following (CWE-59) vulnerability in Paxtechnology Paydroid. Its CVSS base score is 7.8 (High).

Operationally, ranked in the top 39.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow for command execution with high privileges by using malicious symlinks. The attacker must have shell access to the device in order to exploit this vulnerability.

CWE(s)
CWE-59

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

paxtechnology
paydroid
≤ 8.1.0_sagittarius_11.1.50_20230614 · ≤ 8.1.0_sagittarius_11.1.50_20230614 · ≤ 8.1.0_sagittarius_11.1.50_20230614

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References