Paxton10 Access Control System Vulnerable to Unauthenticated RCE

Paxton10 access control systems are vulnerable to unauthenticated remote code execution, letting a network‑adjacent attacker run arbitrary OS commands on the controller and potentially compromise building security across the UK and Europe. The flaw stems from an unprotected I/O connector service that exposes a command‑execution API without authentication, which can be chained with default‑credential web interfaces for full system takeover.

What specific weaknesses enable the attack?

The I/O connector module, designed to trigger doors or alarms, listens on a TCP port that is reachable from any device on the same LAN. It accepts JSON‑encoded commands but performs no authentication or input sanitisation. In parallel, the web management console ships with a well‑known admin account (admin/admin) that many installers never change. Researchers found that the two services share the same process space, allowing a payload delivered via the connector to be executed with system privileges.

How does an attacker exploit the chain of vulnerabilities?

An attacker first scans the building’s subnet for the open connector port (often 5000‑plus). Once identified, a crafted JSON request injects a shell command into the "action" field. Because the service runs as root, the command is executed immediately. The attacker then uses the compromised web console to upload a persistent backdoor or to pivot to other network assets, effectively gaining full control of the access‑control server.

Who is at risk and what deployments are affected?

Paxton10 is installed in thousands of commercial premises across the United Kingdom and Europe, from office blocks to shopping centres. Any site that has enabled the I/O expansion module and retained the factory‑default web credentials is exposed. The vulnerability does not require internet exposure; a malicious insider, a compromised visitor device, or a rogue Wi‑Fi hotspot can serve as the launch point.

Why have these issues persisted despite security best practices?

Building‑automation vendors often prioritize feature rollout over hardening, especially for legacy hardware that cannot be easily patched. The I/O connector was introduced before modern zero‑trust networking concepts were mainstream, and many integrators treat the device as a “closed‑box” that does not need regular updates. Additionally, documentation for disabling the connector or changing default credentials is sparse, leading to widespread mis‑configuration.

What mitigation steps should organizations take right now?

First, segment the VLAN that hosts Paxton10 controllers away from guest or BYOD networks; only authorised management stations should have Layer‑2 access. Second, disable the I/O connector service if it is not actively used, or firewall the port to a trusted IP range. Third, change the default admin password on the web console and enforce strong, unique credentials. Fourth, apply any firmware updates released by Paxton as soon as they become available. Finally, monitor logs for unexpected JSON payloads or repeated connection attempts.

How can GetKhojo help improve your attack‑surface visibility?

GetKhojo’s continuous asset‑discovery engine maps every device on your internal network, flagging exposed ports, default credentials and outdated firmware. By integrating with your SIEM, GetKhojo surfaces I/O‑connector traffic anomalies in real time, giving security teams the context needed to isolate a compromised controller before an attacker can move laterally. Our privacy‑hygiene dashboards also highlight where personal data may be at risk if a building‑automation system is breached.

What does this incident teach about IoT and building security?

The Paxton10 case illustrates that physical‑security hardware is not immune to classic cyber‑attack techniques. When a device exposes an unauthenticated command interface, it becomes a low‑effort foothold for threat actors. Organizations must treat access‑control panels like any other server: enforce least‑privilege network zones, rotate default secrets, and maintain a regular patch cadence.

What this means for you

If your organisation relies on Paxton10 or similar access‑control platforms, immediately audit your network for the exposed I/O port and verify that default credentials have been changed. Deploy network segmentation, disable unused services, and schedule a firmware upgrade. Leveraging GetKhojo’s scanning suite can automate the detection of these gaps and provide ongoing assurance that your building‑security infrastructure remains locked down.

Frequently asked questions

Can I still use Paxton10 after applying the recommended mitigations?

Yes. Disabling the I/O connector or restricting its access, changing default passwords, and installing the latest firmware restores secure operation while preserving core access‑control functionality.

How do I know if my Paxton10 controller has already been compromised?

Look for unexpected logins to the web console, unexplained JSON requests on the I/O port, or new processes running under the controller’s system account. Anomalous outbound traffic from the device is also a strong indicator of compromise.

What network segmentation strategy is best for protecting building‑automation devices?

Place controllers on a dedicated VLAN with no direct routing to guest or employee subnets, and enforce strict firewall rules that only allow management stations and approved I/O devices to communicate with the controller.

Does GetKhojo detect default‑credential issues on IoT devices?

Yes. GetKhojo’s credential‑audit module scans for common default usernames and passwords across discovered assets, alerting you to insecure configurations before attackers can exploit them.

Are there any regulatory implications for a breach of an access‑control system?

A breach that exposes personal data or compromises physical security can trigger data‑protection obligations under GDPR and may be reported to relevant supervisory authorities, depending on the impact.