EUVD-2026-58801
GHSA-3c9q-4rh8-prw5
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Adjacent network vector confirmed by description; daemon requires no authentication (PR:N); high confidentiality from config disclosure; low integrity from config modification; no availability impact described.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
Lifecycle Timeline
2DescriptionCVE.org
PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information and modify configuration on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the XCB daemon. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-30584.
AnalysisAI
Unauthenticated access to the XCB daemon on PAX Technology Q80 payment terminals allows network-adjacent attackers to disclose sensitive configuration data and alter device settings without credentials. The flaw is a complete absence of authentication enforcement at a critical daemon interface (CWE-306), and ZDI explicitly notes this can be chained with additional vulnerabilities to achieve arbitrary code execution in the context of root on the terminal. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The PAX Technology Q80 is a point-of-sale (POS) payment terminal. Its XCB daemon is a background service that exposes functionality over the device's adjacent network interface. CWE-306 (Missing Authentication for Critical Function) describes a fundamental design flaw where a privileged service performs operations without verifying the identity of the requester - in this case, the XCB daemon accepts and acts on requests from any network-adjacent host. The CVSS vector (AV:A) confirms that exploitation is bounded to the local network segment, such as a dedicated retail POS LAN or payment processing VLAN, rather than the open internet. This is consistent with embedded POS device architectures that historically rely on network perimeter controls as a de facto substitute for per-service authentication. The daemon's exposed functionality encompasses both read access to sensitive configuration and write access to modify settings, and ZDI identifies this as a chaining primitive for root-level code execution when combined with a secondary vulnerability.
RemediationAI
No vendor-released patch version has been confirmed in the available data. Operators should immediately consult the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-524/ and contact PAX Technology to obtain any firmware update that introduces authentication to the XCB daemon interface. As an immediate compensating control, restrict network access to Q80 terminals using VLAN segmentation or host-based firewall rules so that only designated management systems can communicate with the XCB daemon - this reduces the attack surface to the AV:A constraint but does not eliminate the vulnerability. Deploying 802.1X port-based network access control on LAN segments hosting Q80 devices can further limit which hosts achieve adjacency to the daemon; the trade-off is operational overhead for certificate or credential management on POS infrastructure. Monitoring for unexpected lateral connections originating from non-POS devices toward Q80 terminal addresses provides low-cost anomaly detection. Note that network segmentation alone does not prevent threats from compromised devices already resident on the POS segment or from insider access.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today