CVE-2023-4818: High severity Paxtechnology Paydroid vulnerability
PAX A920 device allows to downgrade bootloader due to a bug in its version check. The signature is correctly checked and only bootloader signed by PAX can be used.
The attacker must have physical USB access to the device in order to exploit this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-4818?
CVE-2023-4818 is considered a critical vulnerability due to its potential for an attacker to gain unauthorized access to the device's bootloader.
How do I fix CVE-2023-4818?
To mitigate CVE-2023-4818, ensure physical security of the PAX A920 device to prevent unauthorized USB access.
Who is affected by CVE-2023-4818?
CVE-2023-4818 affects all PAX A920 devices running the Paydroid version 7.1.2_aquarius_11.1.50_20230614.
What is the exploitation method for CVE-2023-4818?
CVE-2023-4818 can be exploited by an attacker with physical USB access to the PAX A920 device.
What are the consequences of CVE-2023-4818?
Exploiting CVE-2023-4818 could allow an attacker to downgrade the bootloader, potentially compromising the integrity of the device.