The PAX Technology Q80 device contains a vulnerability in its AIP file parsing mechanism that allows network-adjacent attackers to execute arbitrary code without authentication. The flaw involves the creation of symbolic links that the installer process follows, enabling arbitrary file writes. Exploitation can be combined with other vulnerabilities to achieve code execution as root. The vendor confirmed the affected firmware is end-of-life and unsupported, and users cannot upgrade to a newer firmware. The only recommended mitigation is to restrict interaction with the device. The vulnerability has a CVSS score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) as assigned by ZDI.

Successful exploitation allows an attacker adjacent to the network to execute arbitrary code on the PAX Technology Q80 device without requiring authentication. This can lead to full compromise of the device with root privileges, impacting confidentiality, integrity, and availability. The affected firmware is end-of-life and unsupported, increasing risk due to lack of vendor patches.

No official patch or fix is available because the affected firmware is end-of-life and unsupported. The vendor has not provided a remediation. The only practical mitigation is to restrict network or user interaction with the affected PAX Technology Q80 devices to reduce exposure.