PAX A920 device allows to downgrade bootloader due to a bug in its version check.

published 2024-01-15 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-54661

cvss: 7.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits: 0; none known

PAX A920 device allows to downgrade bootloader due to a bug in its version check. The signature is correctly checked and only bootloader signed by PAX can be used.

The attacker must have physical USB access to the device in order to exploit this vulnerability.

Patch / fix

fixed in 1

PAX Technology A920 A920_AP_Boot_Release_V5.14

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 16 mo ago (2025-06-17)

Exploit prediction

0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

blog.stmcyber.com https://blog.stmcyber.com/pax-pos-cves-2023/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.6	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD	3.1	7.6	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA	3.1	7.6	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

PAX Technology A920

Classification

Weakness

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

blog.stmcyber.com /pax-pos-cves-2023/
technical-description, exploit, third-party-advisory
ppn.paxengine.com /release/development
vendor-advisory, permissions-required
cert.pl /en/posts/2024/01/CVE-2023-4818/
third-party-advisory
cert.pl /posts/2024/01/CVE-2023-4818/
third-party-advisory

Sources

CVE List CVE-2023-4818
NVD CVE-2023-4818

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary