Medium severity · published Oct 23, 2020
CVE-2019-14716
Verifone VerixV Pinpad Payment Terminals with QT000530 have an undocumented physical access mode (aka VerixV shell.out)
6.6
CVSS
0.3%
EPSS
No
On KEV
Description
Verifone VerixV Pinpad Payment Terminals with QT000530 have an undocumented physical access mode (aka VerixV shell.out).
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VO
Verix OS · Verifone
qt000530 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-14716
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-14716
Third Party Advisory
https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2020-27/
More from Verix OS
7.8
CVE-2019-14717
Verifone Verix OS on VerixV Pinpad Payment Terminals with QT000530 have a Buffer Overflow via the Run system call
7.8
CVE-2019-14712
Verifone VerixV Pinpad Payment Terminals with QT000530 allow bypass of integrity and origin control for S1G file generation