CVE-2023-42134: PAX Paydroid POS Device RCE Vulnerability

CVE-2023-42134 Overview

CVE-2023-42134 is a firmware vulnerability affecting PAX Android-based Point of Sale (POS) devices running PayDroid_8.1.0_Sagittarius_V11.1.45_20230314 or earlier versions. The vulnerability allows attackers to overwrite signed partitions and subsequently execute arbitrary local code via a hidden command. This exploit requires physical USB access to the target device.

Critical Impact

Attackers with physical access to affected PAX POS terminals can achieve local code execution by exploiting hidden commands to overwrite signed partitions, potentially compromising payment transaction integrity and sensitive cardholder data.

Affected Products

• PAX Technology PayDroid (versions up to 8.1.0_Sagittarius_V11.1.45_20230314)
• PAX Technology A920 Pro
• PAX Technology A50

Discovery Timeline

• 2024-01-15 - CVE-2023-42134 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-42134

Vulnerability Analysis

This vulnerability stems from the presence of hidden commands within the PAX POS device firmware that can be exploited to overwrite signed partitions. The attack requires physical access to the device via USB connection, making it a targeted attack vector typically executed during supply chain compromise, malicious insider scenarios, or physical device theft.

The core issue relates to CWE-912 (Hidden Functionality), where undocumented commands exist within the device firmware that were not intended for end-user access. When exploited, these hidden commands bypass the signature verification mechanisms designed to protect the integrity of system partitions.

Once an attacker successfully overwrites a signed partition, they can inject malicious code that executes with elevated privileges on the Android-based POS system. This could lead to complete compromise of the payment terminal, enabling attackers to intercept payment card data, manipulate transactions, or establish persistent backdoor access.

Root Cause

The root cause of CVE-2023-42134 lies in the presence of hidden functionality (CWE-912) within the PAX PayDroid firmware. These undocumented commands provide a mechanism to bypass partition signature verification, allowing unauthorized modification of protected system areas. The firmware fails to properly restrict access to these privileged commands when a device is connected via USB, creating an exploitable attack surface for physical attackers.

Attack Vector

The attack requires physical USB access to the affected PAX POS device. An attacker must:

1. Obtain physical access to a vulnerable PAX Android POS terminal
2. Connect to the device via USB interface
3. Execute hidden commands that are not documented or intended for regular use
4. Overwrite signed partitions with malicious payloads
5. Achieve local code execution on the compromised device

The physical access requirement limits the attack surface to scenarios such as supply chain attacks, insider threats, service technician compromise, or theft of devices. However, the impact is severe once access is obtained, as the attacker gains the ability to execute arbitrary code on payment processing hardware.

Detection Methods for CVE-2023-42134

Indicators of Compromise

• Unexpected USB connection events on POS terminals during non-maintenance periods
• Modified partition signatures or integrity check failures on device boot
• Unusual processes or services running on POS devices after physical access events
• Tamper evidence on device enclosures indicating unauthorized physical access

Detection Strategies

• Implement USB port monitoring and logging on all POS terminals to detect unauthorized connections
• Deploy endpoint detection solutions capable of monitoring Android-based POS devices for anomalous behavior
• Establish baseline firmware integrity checks and compare against known-good partition signatures
• Monitor for execution of undocumented or suspicious commands through device audit logs

Monitoring Recommendations

• Enable comprehensive logging on POS device management systems to track all device access events
• Implement physical security monitoring (cameras, access logs) in areas where POS devices are stored or serviced
• Configure alerts for firmware modification attempts or partition integrity failures
• Conduct regular firmware integrity audits against vendor-supplied reference checksums

How to Mitigate CVE-2023-42134

Immediate Actions Required

• Update all affected PAX POS devices to firmware versions released after PayDroid_8.1.0_Sagittarius_V11.1.45_20230314
• Restrict physical access to POS terminals and implement tamper-evident seals
• Audit all devices for signs of unauthorized physical access or tampering
• Review USB access policies and disable USB ports when not required for legitimate maintenance

Patch Information

PAX Technology has addressed this vulnerability in firmware versions released after the affected version. Organizations should consult the PaxEngine Development Release Notes for the latest firmware updates. Security researchers have documented this vulnerability along with related PAX POS issues in the STM Cyber Blog and CERT.pl advisory.

Workarounds

• Implement strict physical security controls around all POS terminals to prevent unauthorized USB access
• Deploy tamper-evident enclosures or seals that indicate when devices have been physically accessed
• Disable USB debugging and development features on production POS devices where possible
• Implement network segmentation to isolate POS devices and limit lateral movement if a device is compromised
• Establish chain of custody procedures for POS devices during deployment, maintenance, and decommissioning