CVE-2023-42136

PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow the execution of arbitrary commands with system account privilege by shell injection starting with a specific word. The attacker must have shell access to the device in order to exploit this vulnerability.

• CWE-77
• CWE-74

• https://blog.stmcyber.com/pax-pos-cves-2023/Exploit, Third Party Advisory
• https://cert.pl/en/posts/2024/01/CVE-2023-4818/Third Party Advisory
• https://cert.pl/posts/2024/01/CVE-2023-4818/Third Party Advisory
• https://ppn.paxengine.com/release/developmentPermissions Required
• https://blog.stmcyber.com/pax-pos-cves-2023/Exploit, Third Party Advisory
• https://cert.pl/en/posts/2024/01/CVE-2023-4818/Third Party Advisory
• https://cert.pl/posts/2024/01/CVE-2023-4818/Third Party Advisory
• https://ppn.paxengine.com/release/developmentPermissions Required

Published

Jan 15, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42130A10 Thunder ADC FileMgmtExport Directory Traversal Arbitrary…8.8
• CVE-2023-42131Ansys SpaceClaim X_B File Parsing Out-Of-Bounds Write Remote…7.8
• CVE-2023-42132FD Application Apr. 2022 Edition (Version 9.01) and earlier …5.5
• CVE-2023-42133PAX Android based POS devices allow for escalation of privil…6.7
• CVE-2023-42134PAX Android based POS devices with PayDroid_8.1.0_Sagittariu…6.8
• CVE-2023-42135PAX A920Pro/A50 devices with PayDroid_8.1.0_Sagittarius_V11.…6.8
• CVE-2023-42137PAX Android based POS devices with PayDroid_8.1.0_Sagittariu…7.8
• CVE-2023-42138Out-of-bounds read vulnerability exists in KV STUDIO Ver. 11…7.8
• CVE-2023-4214The AppPresser plugin for WordPress is vulnerable to unautho…9.8
• CVE-2023-42143Missing Integrity Check in Shelly TRV 20220811-152343/v2.1.8…5.4
• CVE-2023-42144Cleartext Transmission during initial setup in Shelly TRV 20…5.5
• CVE-2023-42147An issue in CloudExplorer Lite 1.3.1 allows an attacker to o…7.5