A missing authentication flaw in the PAX Technology Q80 XCB Daemon exposes critical system functions to unauthorized access by adjacent attackers.

This vulnerability is categorized as a missing authentication for a critical function (CWE-306). It allows an unauthenticated attacker on an adjacent network to interact with the XCB daemon, which lacks the necessary authorization checks to prevent unauthorized command execution or data access.

The lack of authentication on a critical daemon poses a significant risk to the integrity and confidentiality of the affected payment terminal. With a CVSS score of 7.1, this high-severity vulnerability could allow an attacker to gain unauthorized control over device functions, potentially leading to the compromise of sensitive transaction data or disruption of payment processing services.

Immediate Action: Update the PAX Technology Q80 firmware to the version provided by the vendor that addresses this missing authentication flaw.

Proactive Monitoring: Monitor network traffic for unusual activity originating from adjacent devices, specifically targeting the XCB daemon ports.

Compensating Controls: Implement network segmentation to isolate payment terminals from untrusted adjacent devices, effectively restricting the attack surface.

Public Exploit Available: No.

Given the high CVSS score and the nature of the affected device as a payment terminal, organizations must prioritize patching this vulnerability. Ensure that all Q80 units are running the latest firmware to eliminate the authentication bypass risk and prevent potential unauthorized access.