CVE-2023-42134 Code injection in POS terminals

Medium 6.8 Published 15 Jan 2024 Updated 17 Jun 2025

Attackers with physical USB access can overwrite signed partitions on PAX POS devices to execute arbitrary code locally.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-42134?

CVE-2023-42134 is a medium-severity code injection vulnerability in PAX Technology POS terminals, published on 15 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.45_20230314 or earlier can allow the signed partition overwrite and subsequently local code execution via hidden command.

The attacker must have physical USB access to the device in order to exploit this vulnerability.

Weakness: CWE-912

Which versions are affected by CVE-2023-42134?

It affects 1 product.

Products include Paxtechnology Paydroid.

How do I fix CVE-2023-42134?

No fix has been published for CVE-2023-42134 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-42134 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-42134 exists.

Sources

Also known as GHSA-f88h-fg97-9qq5.