PAX Technology Q80 Devices Vulnerable to Remote Code Execution via AIP File Parsing Flaw
A critical vulnerability in PAX Technology Q80 devices allows unauthenticated, network-adjacent attackers to execute arbitrary code by exploiting a flaw in AIP file parsing.
Zero Day Initiative (ZDI) has disclosed a significant remote code execution (RCE) vulnerability, designated ZDI-26-525, affecting PAX Technology Q80 devices. The flaw resides within the device's AIP file parsing component, a critical function for processing application information packages.
This vulnerability presents a severe risk as it allows unauthenticated attackers to execute arbitrary code on affected devices. The attack vector requires the attacker to be on the same network segment as the target device (network-adjacent). Crucially, no form of authentication is needed to exploit this vulnerability, lowering the barrier to entry for malicious actors.
The Zero Day Initiative has assigned a CVSS (Common Vulnerability Scoring System) score of 7.5 to this vulnerability, categorizing it as High severity. This score reflects the potential for significant impact on confidentiality, integrity, and availability, underscoring the urgency for remediation.
While the specific details of the AIP file parsing mechanism and the exact nature of the code execution are not fully disclosed in the initial advisory, such vulnerabilities often stem from improper handling of input data. This could involve buffer overflows, integer overflows, or other memory corruption issues that attackers can leverage to overwrite memory and inject malicious code.
The primary impact of a successful exploitation would be the compromise of the PAX Technology Q80 device. Depending on the device's role and the data it handles, this could lead to unauthorized access to sensitive transaction information, manipulation of payment processes, or the device being used as a pivot point to attack other systems within the same network.
Given the nature of point-of-sale and payment processing devices, the compromise of a PAX Q80 could have direct financial implications for businesses and potentially expose customer payment card data. The network-adjacent requirement suggests that attackers might target devices within a retail environment or compromise a network to gain proximity to vulnerable devices.
As of the disclosure, specific patch information or vendor advisories from PAX Technology were not immediately available, which is common for ZDI disclosures as they often provide vendors with a period to develop and release fixes. Users of PAX Technology Q80 devices are strongly advised to monitor for security updates from the vendor and implement network segmentation and access controls as a precautionary measure.
This vulnerability highlights the ongoing security challenges in the payment processing hardware sector, where specialized devices often become targets for attackers seeking to intercept financial transactions or gain access to sensitive customer data. The ease of exploitation due to the lack of authentication makes this a particularly concerning finding.
This new advisory, ZDI-26-526, details a specific bypass of signature verification within the PAX Technology Q80 application installer. Unlike the previously reported AIP file parsing flaw, this vulnerability allows network-adjacent attackers to execute arbitrary code without requiring authentication, carrying a CVSS score of 7.5.