CVE-2026-19908: PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability
PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information and modify configuration on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the XCB daemon. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-30584.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate the PAX Technology Q80 XCB Daemon Missing Authentication vulnerability (ZDI-CAN-30584) by restricting network access to the XCB daemon so that only trusted network segments/hosts can reach it.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19908?
The severity of CVE-2026-19908 is classified as high with a score of 7.1.
How do I fix CVE-2026-19908?
To fix CVE-2026-19908, ensure that proper authentication mechanisms are enabled for the PAX Technology Q80 XCB Daemon.
What impact does CVE-2026-19908 have on system security?
CVE-2026-19908 allows attackers to disclose sensitive information and modify configuration without authentication, posing a serious risk to system security.
Who is affected by CVE-2026-19908?
Users of PAX Technology Q80 and PAX Technology XCB Daemon installations are affected by CVE-2026-19908.
Can CVE-2026-19908 be exploited remotely?
Yes, CVE-2026-19908 can be exploited by network-adjacent attackers without the need for authentication.