CVE-2023-26980

PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows attackers to bypass the payment software and force the OS to boot directly to Android during the boot process. NOTE: the vendor disputes this because the attack is not feasible: the home launcher will be loaded before any user applications.

• CWE-362

• https://docs.google.com/document/d/189b1494s8RF8ksaOijKhKb-3B8gj3pLUmgn0dqg-jqs/editMailing List, Third Party Advisory
• https://drive.google.com/drive/u/0/folders/14X-XTYhkiaIVBS3zf68VigG4-imbKEuVExploit
• https://uploads.strikinglycdn.com/files/f1d54bf4-3803-480c-b4d3-0943f7dac76e/A920_EN_20200605.pdf?id=237392Broken Link
• https://docs.google.com/document/d/189b1494s8RF8ksaOijKhKb-3B8gj3pLUmgn0dqg-jqs/editMailing List, Third Party Advisory
• https://drive.google.com/drive/u/0/folders/14X-XTYhkiaIVBS3zf68VigG4-imbKEuVExploit
• https://uploads.strikinglycdn.com/files/f1d54bf4-3803-480c-b4d3-0943f7dac76e/A920_EN_20200605.pdf?id=237392Broken Link

Published

Apr 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-2697A vulnerability classified as critical has been found in Sou…9.8
• CVE-2023-26974Irfanview v4.62 allows a user-mode write access violation vi…5.5
• CVE-2023-26976Tenda AC6 v15.03.05.09_multi was discovered to contain a sta…7.5
• CVE-2023-26978TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to con…9.8
• CVE-2023-26979Bluetens Electrostimulation Device BluetensQ device app vers…3.1
• CVE-2023-2698A vulnerability classified as critical was found in SourceCo…9.8
• CVE-2023-26982Trudesk v1.2.6 was discovered to contain a stored cross-site…5.4
• CVE-2023-26984An issue in the password reset function of Peppermint v0.2.4…8.1
• CVE-2023-26986An issue in China Mobile OA Mailbox PC v2.9.23 allows remote…7.8
• CVE-2023-26987An issue discovered in Konga 0.14.9 allows remote attackers …6.5
• CVE-2023-2699A vulnerability, which was classified as critical, has been …9.8
• CVE-2023-26991SWFTools v0.9.2 was discovered to contain a stack-use-after-…7.8