Tahi Wilton Geary

**Name of the Vulnerable Software and Affected Versions** PayRange API (affected versions not specified) **Description** The PayRange API lacks proper authorization on management endpoints, allowing public access to verbose details of every device on the network, regardless of whether the requester has an account. This issue was exploited to bypass authorization and gain unrestricted access to device details across the payment network, facilitating reconnaissance of network topology and potential lateral movement to payment terminals. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Implement runtime segmentation to limit the potential blast radius of an expansion.