CVE-2023-42136
📋 TL;DR
This vulnerability allows shell injection in PAX Android-based POS devices, enabling attackers with shell access to execute arbitrary commands with system privileges. It affects PAX POS devices running PayDroid 8.1.0 Sagittarius V11.1.50 or earlier versions.
💻 Affected Systems
- PAX Android-based POS devices
📦 What is this software?
Paydroid by Paxtechnology
Paydroid by Paxtechnology
Paydroid by Paxtechnology
Paydroid by Paxtechnology
Paydroid by Paxtechnology
Paydroid by Paxtechnology
Paydroid by Paxtechnology
Paydroid by Paxtechnology
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of POS device allowing installation of malware, data theft, payment fraud, and lateral movement to other systems.
Likely Case
Local privilege escalation leading to unauthorized access to payment data, device manipulation, or installation of skimming software.
If Mitigated
Limited impact if shell access is properly restricted and devices are isolated from sensitive networks.
🎯 Exploit Status
Exploitation requires shell access; injection occurs with specific trigger words.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after PayDroid_8.1.0_Sagittarius_V11.1.50_20230614
Vendor Advisory: https://ppn.paxengine.com/release/development
Restart Required: Yes
Instructions:
1. Check current firmware version. 2. Download latest firmware from PAX portal. 3. Apply update via device management interface. 4. Reboot device. 5. Verify update success.
🔧 Temporary Workarounds
Restrict shell access
androidDisable or heavily restrict shell access to POS devices
# Configure device management to disable shell access
# Use ADB or device policies to restrict shell
Network segmentation
allIsolate POS devices from other network segments
# Configure firewall rules to restrict POS device communication
# Implement VLAN segmentation for POS network
🧯 If You Can't Patch
- Implement strict access controls to prevent shell access to devices
- Monitor device logs for shell injection attempts and unusual command execution
🔍 How to Verify
Check if Vulnerable:
Check device firmware version in settings; if PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier, device is vulnerable.Check Version:
adb shell getprop ro.build.version.incrementalVerify Fix Applied:
Verify firmware version is newer than PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 and test shell injection attempts fail.📡 Detection & Monitoring
Log Indicators:
- Unusual shell commands execution
- Commands containing specific trigger words
- Privilege escalation attempts
Network Indicators:
- Unexpected outbound connections from POS devices
- Communication with unknown IPs
SIEM Query:
source="pos-device" AND (command="*specific_word*" OR process="shell" AND user="system")🔗 References
- https://blog.stmcyber.com/pax-pos-cves-2023/
- https://cert.pl/en/posts/2024/01/CVE-2023-4818/
- https://cert.pl/posts/2024/01/CVE-2023-4818/
- https://ppn.paxengine.com/release/development
- https://blog.stmcyber.com/pax-pos-cves-2023/
- https://cert.pl/en/posts/2024/01/CVE-2023-4818/
- https://cert.pl/posts/2024/01/CVE-2023-4818/
- https://ppn.paxengine.com/release/development
