Reported by 1 outlet

Timeline

1. original reporting

   PAX Q80 SmartPOS signature verification bypass (ZDI-26-526) lets network-adjacent attackers execute code

   securityarsenal.com · 59d ago · August 15th, 2026

   The Zero Day Initiative published ZDI-26-526, a signature verification bypass in the PAX Technology Q80, a widely deployed Android-based SmartPOS payment terminal. Two CVEs were assigned, CVE-2026-19910 and CVE-2026-19911, carrying a combined ZDI CVSS rating of 7.5. The flaw sits in the Application Installer subsystem, the component responsible for validating and installing application packages on the device: the installer fails to properly validate package signatures under specific conditions, so an attacker positioned on the same network segment can deliver a malicious application package that the device accepts and executes, with no authentication required and no physical access. There is no patch yet; PAX has not released fixed firmware. No confirmed in-the-wild exploitation or public PoC has been reported as of publication, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog. Network adjacency is the only prerequisite, which on flat retail LANs or poorly segmented store networks puts the entire cardholder data environment at risk; exploitation could let an attacker deploy persistent malicious applications capable of intercepting payment flows, scraping track data or PIN pad interactions, and pivoting further into the CDE. Defenders should hard-segment the POS estate, enforce management-port ACLs (ADB ports 5555 and 5037), filter egress from the POS VLAN, and treat package-install activity from non-management hosts as an incident until PAX ships a fix.