CVE-2019-14713 : Security Advisory and Response

Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow installation of unsigned packages.

Understanding CVE-2019-14713

The Pinpad Payment Terminals of Verifone MX900 series, operating on OS 30251000, have the capability to install packages that are not digitally signed.

What is CVE-2019-14713?

This CVE identifies a vulnerability in Verifone MX900 series Pinpad Payment Terminals that permits the installation of unsigned packages.

The Impact of CVE-2019-14713

Unauthorized installation of unsigned packages can lead to potential security breaches and compromise sensitive data on the payment terminals.

Technical Details of CVE-2019-14713

Vulnerability Description

The vulnerability allows attackers to install packages that are not digitally signed, potentially introducing malicious software onto the payment terminals.

Affected Systems and Versions

Product: Verifone MX900 series
Operating System: OS 30251000
Versions: All versions operating on OS 30251000

Exploitation Mechanism

Attackers can exploit this vulnerability by installing malicious packages that are not digitally signed, compromising the security of the payment terminals.

Mitigation and Prevention

Immediate Steps to Take

Disable the capability to install unsigned packages on the Verifone MX900 series Pinpad Payment Terminals.
Regularly monitor for any unauthorized software installations.

Long-Term Security Practices

Implement strict access controls to prevent unauthorized access to the payment terminals.
Conduct regular security audits and updates to ensure the integrity of the payment terminal systems.

Patching and Updates

Apply patches or updates provided by Verifone to address this vulnerability and enhance the security of the payment terminals.