Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-19909— PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability

Quick assessment

Affected
PAX Technology Q80
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PAX Technology Q80是中国PAX Technology公司的一款物联网设备。 PAX Technology Q80 2.6.33.6690R版本存在后置链接漏洞，该漏洞源于AIP文件解析过程中存在链接跟随问题，攻击者可通过创建符号链接滥用安装程序进程写入任意文件，进而结合其他漏洞以root权限执行任意代码。

AI Predicted 9.8 Difficulty: Easy EPSS 0.50% · P41

Affected Version Matrix 1

VendorProduct Version RangeStatus
PAX Technology Q80 2.6.33.6690R affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-19909

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of AIP files. By creating a symbolic link, an attacker can abuse the installer process to write arbitrary files. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-30583.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5
Vulnerability Title
PAX Technology Q80 后置链接漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PAX Technology Q80是中国PAX Technology公司的一款物联网设备。 PAX Technology Q80 2.6.33.6690R版本存在后置链接漏洞，该漏洞源于AIP文件解析过程中存在链接跟随问题，攻击者可通过创建符号链接滥用安装程序进程写入任意文件，进而结合其他漏洞以root权限执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
PAX Technology Q80 2.6.33.6690R -

II. Public POCs for CVE-2026-19909

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-19909

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-19909 (1)

Same Patch Batch · PAX Technology · 2026-08-14 · 3 CVEs total

CVE-2026-19908 PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability
CVE-2026-19910 PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Executi

IV. Related Vulnerabilities

Same product: Q80
Same vendor: PAX Technology
Same weakness: CWE-59

V. Comments for CVE-2026-19909

No comments yet

Leave a comment