CVE-2023-4818

CVSS 7.6 HIGHEPSS 0.7%CWE-74

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 7.6EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

15 ene 2024Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

PAX A920 device allows to downgrade bootloader due to a bug in its version check. The signature is correctly checked and only bootloader signed by PAX can be used. The attacker must have physical USB access to the device in order to exploit this vulnerability.

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Productos afectados

PAX Technology · A920

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://blog.stmcyber.com/pax-pos-cves-2023/https://cert.pl/en/posts/2024/01/CVE-2023-4818/https://cert.pl/posts/2024/01/CVE-2023-4818/https://ppn.paxengine.com/release/development