This vulnerability in the PAX Technology Q80 XCB daemon allows attackers on the same network segment to bypass authentication controls and interact with the daemon's functionality. The lack of authentication enables disclosure of sensitive information and modification of device configuration. The flaw was reported to the vendor, who confirmed the affected firmware is end-of-life and no longer supported. The vendor disputed the impact on supported releases but confirmed the issue on the reported firmware. No firmware updates or patches are available, and users cannot upgrade to newer firmware. The advisory recommends restricting interaction with the device as the primary mitigation. The vulnerability has a CVSS rating of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

An attacker who is network-adjacent can exploit this vulnerability without any authentication to disclose sensitive information and modify the configuration of the affected PAX Technology Q80 device. This unauthorized access could be leveraged alongside other vulnerabilities to achieve arbitrary code execution with root privileges. The vulnerability does not require user interaction and has a low attack complexity. The impact includes high confidentiality impact, low integrity impact, and no availability impact.

No official patch or firmware update is available as the affected firmware is end-of-life and unsupported. The vendor has not provided a fix for this vulnerability. The primary mitigation is to restrict network access to the affected PAX Technology Q80 devices, limiting interaction only to trusted and necessary network segments. Users should isolate the device from untrusted networks to reduce exposure.