Physical Access Vulnerability in PAX Point Of Sale Devices by PAX Technology
CVE-2020-28044

6.8MEDIUM

Key Information:

Vendor

Pax

Status
Prolinos
Vendor
CVE Published:
2 November 2020

What is CVE-2020-28044?

A security flaw in PAX Point Of Sale devices running ProlinOS allows an attacker with physical access to boot the device in management mode. This vulnerability enables unauthorized users to activate the XCB service, granting them the ability to list, read, create, and overwrite files with the permissions typically reserved for MAINAPP. This can lead to significant data breaches and compromise the integrity of the device.

References

https://git.lsd.cat/g/pax-pwn
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.