ZDI 2026-08-05

ZDI-26-525: (0Day) PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability

Machine-generated analysis · WAYSCloud LLM

Unauthenticated attackers can achieve remote code execution on PAX Technology Q80 via crafted AIP files.

Context

The advisory concerns PAX Technology Q80 devices. It describes an unauthenticated remote code execution vulnerability triggered by link-following in AIP file parsing. The issue can be exploited by attackers on the same network segment.

Operator considerations

Check: Verify which Q80 devices are present and their software versions.
Isolate: Limit network exposure of Q80 devices to trusted zones.

From Zero Day Initiative ↗

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.

Read the full advisory on ZDI →