CVE-2019-14717
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code on Verifone VerixV Pinpad Payment Terminals by exploiting a buffer overflow in the Run system call. It affects payment terminals running Verifone Verix OS with specific firmware. Successful exploitation could compromise payment processing systems and sensitive financial data.
💻 Affected Systems
- Verifone VerixV Pinpad Payment Terminal
📦 What is this software?
Verix Os by Verifone
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install persistent malware, intercept payment card data, manipulate transactions, and potentially compromise connected payment networks.
Likely Case
Terminal compromise leading to payment card data theft (card skimming), transaction manipulation, or denial of service affecting payment processing.
If Mitigated
Limited impact if terminals are properly segmented, monitored, and have restricted system call access, though buffer overflow could still cause crashes.
🎯 Exploit Status
Buffer overflow via system call suggests local or network-accessible exploitation. Payment terminals are attractive targets for financial crime groups.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware versions after QT000530
Vendor Advisory: https://www.verifone.com/en/us/support/security-updates
Restart Required: Yes
Instructions:
1. Contact Verifone support for latest firmware. 2. Backup terminal configuration. 3. Apply firmware update via secure method. 4. Verify update completion. 5. Restart terminal.
🔧 Temporary Workarounds
Restrict System Call Access
allLimit access to Run system call through OS configuration if supported
Configuration varies by Verix OS version - consult Verifone documentation
Network Segmentation
allIsolate payment terminals from general network access
Implement firewall rules to restrict terminal communication to payment processors only
🧯 If You Can't Patch
- Physically secure terminals to prevent unauthorized access
- Implement strict monitoring for abnormal terminal behavior or network traffic
🔍 How to Verify
Check if Vulnerable:
Check terminal firmware version via admin menu: Settings > System Information > Firmware VersionCheck Version:
Terminal-specific: Access admin menu and navigate to firmware informationVerify Fix Applied:
Verify firmware version is newer than QT000530 and test Run system call functionality📡 Detection & Monitoring
Log Indicators:
- Multiple failed Run system call attempts
- Unexpected process execution
- System crash/restart logs
Network Indicators:
- Unusual outbound connections from terminals
- Traffic to non-payment processor endpoints
SIEM Query:
source="payment_terminal" AND (event="system_call_failure" OR event="unexpected_process")