EUVD-2026-58802
GHSA-q98c-hxqr-rgv7
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent vector reflects POS terminal LAN context; AC:H reflects mandatory chaining requirement; PR:N confirmed by ZDI; full C/I/A from root-level code execution on the device.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
Lifecycle Timeline
2DescriptionCVE.org
PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the application installer. The issue results from the lack of proper verification of a cryptographic signature before installing an application. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-30585.
AnalysisAI
Signature verification bypass in the PAX Technology Q80 payment terminal's application installer enables network-adjacent unauthenticated attackers to install unsigned or malicious applications, which when chained with a secondary vulnerability results in arbitrary code execution at the root privilege level. The flaw stems from the installer's failure to properly validate cryptographic signatures - tagged as a JWT attack vector - before accepting and executing application packages. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be network-adjacent to the Q80 - on the same LAN, VLAN, or wireless network segment - which explicitly excludes direct internet-sourced attacks. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 base score of 7.5 with vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H reflects meaningful but conditionally constrained real-world risk: the adjacent network requirement (AV:A) limits the attacker population to those with physical or logical proximity to the payment terminal network, and the high complexity rating (AC:H) signals that exploitation requires chaining this bypass with at least one additional independently identified vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to review the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-526/ and apply any firmware or installer update issued by PAX Technology for the Q80; no specific patched firmware version number is confirmed in the current intelligence and must be obtained directly from PAX Technology. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Q80 payment terminals in your environment and restrict their network access to trusted payment processing systems only; document device inventory, serial numbers, and locations; review recent transaction logs and payment processor alerts for anomalous activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Share
External POC / Exploit Code
Leaving vuln.today