CVE-2026-19908
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Vulnerability in PAX Technology Q80 XCB daemon is due to missing authentication before allowing access to functionality, allowing a network-adjacent attacker to disclose sensitive information and modify configuration.
Risk Assessment
An attacker can access sensitive data and change configuration, potentially leading to privilege escalation and device compromise.
Recommendation
Apply patches from PAX Technology for the Q80 device.
Other vulnerabilities in PAX Technology Q80
See all- CVE-2026-19910High
Vulnerability in PAX Technology Q80 Application Installer allows bypass of cryptographic signature verification, enabling remote code execution by a network-adjacent attacker without authentication.
- CVE-2026-19909High
Vulnerability in PAX Technology Q80 AIP file parsing allows link following, enabling remote code execution by a network-adjacent attacker without authentication.
Original NVD description (English source)
PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information and modify configuration on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the XCB daemon. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-30584.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS