What is the CVSS score of CVE-2026-19909?

CVE-2026-19909 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of PAX Technology Q80 are affected by CVE-2026-19909?

PAX Technology Q80 AIP payment terminals contain an unpatched arbitrary file-write vulnerability (CVSS 7.5) reachable from the local network by unauthenticated attackers.

How to fix or mitigate CVE-2026-19909?

Within 24 hours: Inventory all Q80 AIP terminals in production and document their network location and access paths. Within 7 days: Implement network segmentation to isolate Q80 AIP terminals from untrusted network segments, restrict administrative access to trusted terminals only, and document any air-gap or network isolation already in place. Within 30 days: Monitor PAX Technology security advisories for patch availability; if no patch emerges within 90 days, initiate terminal replacement planning and engage PAX Technology support for alternative remediation guidance.

PAX Technology Q80 CVE-2026-19909

EUVD-2026-58800 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-08-14 zdi-disclosures@trendmicro.com

GHSA-83w9-7r9f-f3qm

RCE

7.5

CVSS 3.0 · Vendor: trendmicro

Severity by source

Vendor (trendmicro) PRIMARY

7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Adjacent vector and AC:H confirmed by description; PR:N explicit; impact metrics reflect root-level write primitive potential when chained, consistent with C:H/I:H/A:H.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (trendmicro).

CVSS VectorVendor: trendmicro

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 20:31 vuln.today

CVE Published

Aug 14, 2026 - 20:16 cve.org

HIGH 7.5

DescriptionCVE.org

PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the parsing of AIP files. By creating a symbolic link, an attacker can abuse the installer process to write arbitrary files. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-30583.

AnalysisAI

Arbitrary file write via link-following in PAX Technology Q80 AIP file parsing allows network-adjacent unauthenticated attackers to place attacker-controlled content at arbitrary filesystem paths by embedding a crafted symbolic link within an AIP installer package. This primitive cannot independently achieve code execution - it must be chained with at least one additional vulnerability to reach root-level RCE on the payment terminal. Disclosed through ZDI coordinated disclosure (ZDI-CAN-30583/ZDI-26-525); no public exploit has been identified at time of analysis.

Technical ContextAI

CWE-59 (Improper Link Resolution Before File Access - 'Link Following') arises when a privileged process resolves attacker-controlled symbolic links during file operations without confining writes to an expected directory boundary. In the PAX Technology Q80 - a point-of-sale payment terminal running an embedded Linux-based stack - the AIP file installer/parser fails to canonicalize or jail symlink targets before writing extracted content, allowing traversal to arbitrary filesystem locations. AIP files appear to be a proprietary installer package format used to deploy software or updates to the Q80 device. Because the installer likely runs as root (a common pattern on embedded POS firmware), any file written through the symlink inherits that privilege level, making this a high-value write primitive for subsequent privilege escalation chains. CPE identifiers for the affected firmware versions were not provided in the source data.

RemediationAI

Apply the vendor-released patch from PAX Technology addressing ZDI-26-525 - the exact patched firmware version is not confirmed in the available data and must be obtained directly from PAX Technology or via the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-525/. As a compensating control, enforce strict network segmentation isolating Q80 terminals to their own VLAN with access control lists preventing unauthorized adjacent-network hosts from communicating with the devices - this directly neutralizes the AV:A attack vector. If remote or automated AIP-based software updates are not operationally required, disable or restrict the AIP installer trigger mechanism to reduce the attack surface; note this may impact firmware manageability. Monitor Q80 devices for unexpected file creation in system binary paths (e.g., /bin, /sbin, /usr) as an indicator of symlink-following exploitation. Since exploitation requires chaining a second vulnerability for RCE, reducing the overall attack surface on the Q80 firmware is an effective defense-in-depth measure.