Remote Code Execution in PAX Technology Q80 AIP File Parsing

CVE-2026-19909

What is CVE-2026-19909?

Network-adjacent attackers can exploit a vulnerability in the PAX Technology Q80's AIP file parsing process to gain unauthorized access, executing arbitrary code without requiring authentication. By manipulating symbolic links during the installation process, an attacker can write files in the context of the affected system, potentially elevating their privileges and compromising the device further. This vulnerability highlights significant security risks that can be amplified when combined with other loopholes.

References