CVE-2020-28044

An attacker with physical access to a PAX Point Of Sale device with ProlinOS through 2.4.161.8859R can boot it in management mode, enable the XCB service, and then list, read, create, and overwrite files with MAINAPP permissions.
References
Link Resource
https://git.lsd.cat/g/pax-pwn Third Party Advisory
https://git.lsd.cat/g/pax-pwn Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:o:pax:prolinos:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:22

Type Values Removed Values Added
References () https://git.lsd.cat/g/pax-pwn - Third Party Advisory () https://git.lsd.cat/g/pax-pwn - Third Party Advisory

Information

Published : 2020-11-02 21:15

Updated : 2024-11-21 05:22


NVD link : CVE-2020-28044

Mitre link : CVE-2020-28044

CVE.ORG link : CVE-2020-28044


JSON object : View

Products Affected

pax

  • prolinos
CWE
CWE-276

Incorrect Default Permissions