CVE-2023-26980

PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows...

7.0 HighDisputed

PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows attackers to bypass the payment software and force the OS to boot directly to Android during the boot process. NOTE: the vendor disputes this because the attack is not feasible: the home launcher will be loaded before any user applications.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.28%Up 0.2 points since Apr 15, 2023

What each source reports

NVD Score used 7.0

Record: CVE-2023-26980
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-362
Updated: 2026-11-02

CVE List No score

Record: CVE-2023-26980
Updated: 2026-11-02

EUVDEUVD-2023-30770 No score

Record: EUVD-2023-30770
Updated: 2026-11-03

GitHub AdvisoriesGHSA-q7gw-cx2f-mh8f 7.0

PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows...

Record: GHSA-q7gw-cx2f-mh8f
CVSS 3.1: 7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-362
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-26980 is a high vulnerability (CVSS 7.0) in Pax Paydroid, published April 14, 2023. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile.