CVE-2023-4818
📋 TL;DR
PAX A920 payment terminals have a bootloader downgrade vulnerability due to improper version checking. Attackers with physical USB access can install older, potentially vulnerable bootloader versions, compromising device security. This affects PAX A920 devices in retail and payment environments.
💻 Affected Systems
- PAX A920
📦 What is this software?
Paydroid by Paxtechnology
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing installation of malicious firmware, payment data theft, and persistent backdoor establishment.
Likely Case
Installation of older bootloader with known vulnerabilities, enabling subsequent attacks on the payment terminal.
If Mitigated
Limited impact if physical access controls prevent USB connection by unauthorized personnel.
🎯 Exploit Status
Exploitation requires physical access to USB port; signature verification still works but version check bypass allows downgrade.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in public sources; check PAX vendor updates.
Vendor Advisory: https://ppn.paxengine.com/release/development
Restart Required: Yes
Instructions:
1. Contact PAX support for firmware update. 2. Apply latest firmware via official PAX tools. 3. Reboot device to activate new bootloader.
🔧 Temporary Workarounds
Physical Access Control
allRestrict physical access to USB ports to prevent unauthorized connections.
Device Tamper Detection
allImplement monitoring for unauthorized physical access to payment terminals.
🧯 If You Can't Patch
- Physically secure devices in controlled environments to prevent USB access.
- Implement regular physical security audits and tamper detection mechanisms.
🔍 How to Verify
Check if Vulnerable:
Check bootloader version via PAX diagnostic tools; if version is older than latest patched version, device may be vulnerable.Check Version:
Use PAX proprietary diagnostic tools; specific command not publicly documented.Verify Fix Applied:
Verify bootloader version matches latest patched version from PAX vendor after update.📡 Detection & Monitoring
Log Indicators:
- USB connection logs from unauthorized devices
- Bootloader version change events
Network Indicators:
- Not applicable - physical access required
SIEM Query:
Not applicable for network detection; focus on physical security logs.🔗 References
- https://blog.stmcyber.com/pax-pos-cves-2023/
- https://cert.pl/en/posts/2024/01/CVE-2023-4818/
- https://cert.pl/posts/2024/01/CVE-2023-4818/
- https://ppn.paxengine.com/release/development
- https://blog.stmcyber.com/pax-pos-cves-2023/
- https://cert.pl/en/posts/2024/01/CVE-2023-4818/
- https://cert.pl/posts/2024/01/CVE-2023-4818/
- https://ppn.paxengine.com/release/development
