CVE-2026-19908

HighCVSS 7.1

Published: 14/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

Vulnerability in PAX Technology Q80 XCB daemon is due to missing authentication before allowing access to functionality, allowing a network-adjacent attacker to disclose sensitive information and modify configuration.

Risk Assessment

An attacker can access sensitive data and change configuration, potentially leading to privilege escalation and device compromise.

Recommendation

Apply patches from PAX Technology for the Q80 device.

Original NVD description (English source)

PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information and modify configuration on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the XCB daemon. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-30584.