CVE-2023-4818

PAX A920 device allows to downgrade bootloader due to a bug in its version check. The signature is correctly checked and only bootloader signed by PAX can be used. The attacker must have physical USB access to the device in order to exploit this vulnerability.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 0.9 / Impact : 6.0

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://blog.stmcyber.com/pax-pos-cves-2023/	Exploit Third Party Advisory
https://cert.pl/en/posts/2024/01/CVE-2023-4818/	Third Party Advisory
https://cert.pl/posts/2024/01/CVE-2023-4818/	Third Party Advisory
https://ppn.paxengine.com/release/development	Permissions Required

Configurations

Configuration 1 (hide)

AND

cpe:2.3:h:paxtechnology:a920:-:*:*:*:*:*:*:*

cpe:2.3:o:paxtechnology:paydroid:7.1.2_aquarius_11.1.50_20230614:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-01-15 14:15

Updated : 2024-01-19 16:35

NVD link : CVE-2023-4818

Mitre link : CVE-2023-4818

CVE.ORG link : CVE-2023-4818

JSON object : View

Products Affected

paxtechnology

paydroid
a920

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-20

Improper Input Validation

{"id": "CVE-2023-4818", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "PHYSICAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 0.9}]}, "published": "2024-01-15T14:15:25.180", "references": [{"url": "https://blog.stmcyber.com/pax-pos-cves-2023/", "tags": ["Exploit", "Third Party Advisory"], "source": "cvd@cert.pl"}, {"url": "https://cert.pl/en/posts/2024/01/CVE-2023-4818/", "tags": ["Third Party Advisory"], "source": "cvd@cert.pl"}, {"url": "https://cert.pl/posts/2024/01/CVE-2023-4818/", "tags": ["Third Party Advisory"], "source": "cvd@cert.pl"}, {"url": "https://ppn.paxengine.com/release/development", "tags": ["Permissions Required"], "source": "cvd@cert.pl"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-74"}]}, {"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "PAX A920 device allows to downgrade bootloader due to a bug in its version check. The signature is correctly checked and only bootloader signed by PAX can be used.\u00a0\n\n\n\n\nThe attacker must have physical USB access to the device in order to exploit this vulnerability.\n\n"}, {"lang": "es", "value": "El dispositivo PAX A920 permite degradar el gestor de arranque debido a un error en la verificaci\u00f3n de versi\u00f3n. La firma est\u00e1 correctamente comprobada y s\u00f3lo se puede utilizar el gestor de arranque firmado por PAX. El atacante debe tener acceso USB f\u00edsico al dispositivo para poder aprovechar esta vulnerabilidad."}], "lastModified": "2024-01-19T16:35:49.683", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:paxtechnology:a920:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D351F870-D43F-48B4-B2AC-0FDDD7B82ED4"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:paxtechnology:paydroid:7.1.2_aquarius_11.1.50_20230614:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "034C08E1-1DEB-43D2-A38A-736E1FEDE45C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cvd@cert.pl"}