CVE-2023-4818

CVE-2023-4818 describes a bootloader downgrade vulnerability in PAX A920 and PayDroid devices, stemming from a flaw in the version check mechanism. An attacker with physical USB access can exploit this to install an older, potentially vulnerable bootloader, despite signature checks ensuring only PAX-signed bootloaders are used. This high-severity vulnerability (CVSS 7.6) allows for significant impact on confidentiality, integrity, and availability, though it requires physical presence. There is no evidence of active exploitation, public exploit code, or significant community discussion, with only one article covering the issue.