The vulnerability in PAX Technology Q80 arises from improper handling of symbolic links during the parsing of AIP files. An attacker can create a symbolic link that the installer process follows, enabling arbitrary file writes. This can lead to remote code execution in the context of root when chained with other vulnerabilities. The vulnerability is identified as CWE-59 (Improper Link Resolution Before File Access). It affects versions =2.6.33.6690 and 2.6.33.6690R. The CVSS v3.0 score is 7.5, indicating high severity, with attack vector as adjacent network, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker who is adjacent on the network can exploit this vulnerability without authentication to write arbitrary files by abusing symbolic link handling in the AIP file parsing process. This can lead to remote code execution with root privileges if combined with other vulnerabilities, potentially compromising the entire system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published at this time. Monitor vendor communications for updates and apply patches promptly once available.