CVE-2023-4818 is a high severity (CVSS 7.6 in NVD) bootloader downgrade flaw in the PAX A920 payment terminal. A bug in the version check lets an attacker with physical USB access install an older signed bootloader. The researchers verified the fix in PayDroid build V02.9.99T9_20230919, so update.
What's affected
The NVD record says the PAX A920 allows a bootloader downgrade because of a bug in its version check. The signature is correctly checked and only a bootloader signed by PAX can be used. The attacker must have physical USB access to the device.
CERT Polska lists the vulnerable versions as all through A920_AP_Boot_Release_V5.14 and says the vendor confirmed the issue and fixed it in newer releases. The STM Cyber write up gives the fixed build: it names PayDroid 7.1.2_Aquarius_V02.9.99T9_20230919 as the fix verified, and PayDroid 7.1.2_Aquarius_11.1.50_20230614 as a known vulnerable version.
Severity differs by source. NVD gives 7.6, and the researchers give 7.3 for the same issue. Both are high, and both rest on physical access.
How to check if you're exposed
Payment terminals are managed by the acquirer or the terminal management system, not by the shop. Ask your provider for the firmware inventory, and compare each A920 build with the fixed build named above.
On the device, the system information screen shows the software version, though the exact path depends on your configuration.
Also check physical controls. Who can plug a cable into a terminal at the counter, in transit, in storage and in repair?
Keep a list of terminals with serial numbers and locations, so you can find and update each one.
What to do now
- Ask your payment provider which A920 firmware each terminal runs.
- Schedule the update to a fixed build through the terminal management system.
- Seal or monitor USB ports where practical, and keep spare terminals locked away.
- Inspect devices that left your control, such as returns and repairs, before you put them back in service.
- Add terminals to your asset register with firmware versions.
Why it matters
The record maps this to CWE-74. The researchers say the cause was improper tokenization in the version check, so the downgrade could pass the check. That let an older bootloader with known weaknesses be installed, even though signatures were still enforced.
Physical access is a real limit, but payment terminals are exactly the devices that spend time in shops, in couriers hands and in repair queues. Downgrade attacks defeat the idea that every update makes a device safer. The record does not claim exploitation and the CVE is not in the CISA KEV catalog.
Quick check
Can this be exploited over the network?
No. The record says the attacker needs physical USB access to the terminal.
Sources
Last reviewed: 19 October 2026.
