LiveActive security incident?Get immediate response
CVE Record

CVE-2020-36128: Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by a token spoofing vulnerability.

Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by a token spoofing vulnerability. Each payment terminal has a session token (called X-Terminal-Token) to access the marketplace. This allows the store to identify the terminal and make available the applications distributed by its reseller. By intercepting HTTPS traffic from the application store, it is possible to collect the request responsible for assigning the X-Terminal-Token to the terminal, which makes it possible to craft an X-Terminal-Token pretending to be another device. An attacker can use this behavior to authenticate its own payment terminal in the application store through token impersonation.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This flaw affects PAXSTORE builds v7.0.8_20200511171508 and lower, according to the CVE text. A terminal token could be spoofed so an attacker-controlled payment terminal appears to the app store as another device. Business risk depends on how the marketplace is deployed and monitored.

Executive priority

Treat this as a targeted payment-terminal platform risk until vendor status is confirmed. Prioritize environments where PAXSTORE controls application availability for deployed payment terminals, because identity spoofing could undermine reseller or terminal-level trust boundaries.

Technical view

The CVE describes spoofing of the X-Terminal-Token used by payment terminals to access the marketplace. By obtaining the token-assignment request, an attacker could craft a token that impersonates another terminal. The bundle provides no CVSS, CWE, named patch, or confirmed affected CPE data.

Likely exposure

Exposure is most likely in organizations operating PAXSTORE-connected Pax payment terminal fleets on the named affected builds or earlier. The source metadata does not provide complete product, CPE, deployment, or patch information.

Exploitation context

The provided sources do not show CISA KEV listing or active exploitation. The described abuse requires access to relevant marketplace traffic and a terminal capable of using the spoofed identity. Operational impact is uncertain from the bundle alone.

Researcher notes

The source bundle is thin: no CVSS vector, CWE, CPE, vendor advisory, or fix version is included. Analysis should stay anchored to the CVE description and the PrideSec reference, and avoid assuming broader Pax product impact.

Mitigation direction

  • Confirm vendor guidance for affected PAXSTORE versions and available fixes.
  • Upgrade or reconfigure PAXSTORE only according to official vendor instructions.
  • Review controls that bind terminal tokens to device identity and reseller scope.
  • Monitor marketplace logs for unexpected terminal identity changes or app availability.
  • Rotate or reissue terminal tokens where vendor-supported after exposure concerns.

Validation and detection

  • Inventory PAXSTORE version/build across marketplace and terminal management environments.
  • Identify terminals using builds at or below v7.0.8_20200511171508.
  • Check marketplace logs for terminal-token issuance anomalies.
  • Verify whether current deployments bind X-Terminal-Token to expected terminal identity.
  • Document vendor patch or mitigation status for vulnerability management records.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-36128 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.