January 16, 2024 at 11:12AM
PAX Technology’s Android-based PoS terminals are vulnerable to multiple exploits allowing attackers to execute arbitrary code or commands, according to a report by STM Cyber. The vulnerabilities, affecting various PAX devices, include the ability to manipulate payment data, inject shell commands, and execute arbitrary code with root privileges. Patches have been released by PAX following the disclosure.
Key takeaways from the meeting notes are as follows:
– The Android-based PoS terminals from PAX Technology are affected by a series of vulnerabilities that can be exploited to execute arbitrary code or commands, as reported by penetration testing firm STM Cyber.
– PAX, headquartered in China, manufactures payment terminals, PIN pads, and PoS hardware and software sold globally. The PoS devices from PAX run on PayDroid, which is based on Android.
– Vulnerabilities identified by STM Cyber allow attackers to tamper with applications, including the payment process, by gaining root access to the terminal.
– STM Cyber has identified six vulnerabilities in the PAX PoS devices, three of which can be exploited by attackers with physical USB access to the vulnerable device.
– Patches for all vulnerabilities have been released by PAX after being informed of the issues by STM Cyber and CERT Poland.
Let me know if you need any additional information or if there is anything else I can assist you with.