CVE-2023-42137 Path traversal in POS terminals

High 7.8 Published 15 Jan 2024 Updated 17 Jun 2025

Attackers with shell access can execute commands with high privileges on PAX POS devices via malicious symlinks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-42137?

CVE-2023-42137 is a high-severity path traversal vulnerability in PAX Technology POS terminals, published on 15 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow for command execution with high privileges by using malicious symlinks.

The attacker must have shell access to the device in order to exploit this vulnerability.

Weakness: CWE-59

Which versions are affected by CVE-2023-42137?

It affects 1 product.

Products include Paxtechnology Paydroid.

How do I fix CVE-2023-42137?

No fix has been published for CVE-2023-42137 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-42137 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-42137 exists.

Sources

Also known as GHSA-w8g8-vhwr-gr27.