PAX PoS Terminal Flaw Could Allow Attackers to Tamper with Transactions

STM Cyber R&D reverse-engineered Android-based PAX PoS terminals and reported several high-severity vulnerabilities (CVE-2023-42133 [details withheld], CVE-2023-42134, CVE-2023-42135, CVE-2023-42136, CVE-2023-42137, CVE-2023-4818) that enable local code execution, privilege escalation to root, and bootloader downgrade; successful exploitation could let attackers tamper with payment transactions and amounts. Some issues require physical USB access or prior shell access; vulnerabilities were responsibly disclosed and PAX released patches in November 2023.