CVE-2023-26980 Race condition in n/a
Attackers can bypass payment software to boot directly to Android via a race condition, though the vendor disputes feasibility.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-26980?
CVE-2023-26980 is a high-severity vulnerability in n/a, published on 14 Apr 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows attackers to bypass the payment software and force the OS to boot directly to Android during the boot process. NOTE: the vendor disputes this because the attack is not feasible: the home launcher will be loaded before any user applications.
Weakness: CWE-362
Which versions are affected by CVE-2023-26980?
It affects 1 product.
Products include Pax Paydroid.
How do I fix CVE-2023-26980?
No fix has been published for CVE-2023-26980 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-26980 being exploited?
There is no known exploitation of CVE-2023-26980 in the wild and no public exploit code.
Sources
Also known as GHSA-q7gw-cx2f-mh8f.