This vulnerability in the PAX Technology Q80's XCB daemon allows attackers on the same network to bypass authentication and access sensitive information or modify configuration settings. The root cause is the absence of authentication checks before granting access to daemon functionality. The Zero Day Initiative assigned a CVSS score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). The vendor confirmed the affected firmware is end-of-life and no updates are available. Attempts to engage the vendor for remediation on supported releases were disputed, and the vendor requested an extension before public disclosure. The vulnerability can be leveraged with other flaws to achieve arbitrary code execution as root. The advisory recommends restricting network access to mitigate risk.

An attacker who is network-adjacent can exploit this vulnerability without any authentication to disclose sensitive information and modify configuration on the affected PAX Technology Q80 device. The vulnerability has a high severity rating (CVSS 7.1) due to the potential confidentiality impact and configuration modification. Additionally, it can be chained with other vulnerabilities to execute arbitrary code with root privileges, increasing the risk of full device compromise. No known exploits are reported in the wild at this time.

No official patch or firmware update is available because the affected firmware is end-of-life and unsupported. The vendor disputes the impact on supported releases and has not provided a fix. The only effective mitigation is to restrict network access to the affected device, limiting interaction to trusted networks or isolating the device to prevent unauthorized access. Monitor vendor advisories for any future updates or support changes.