Credit Card Payment Terminal Exploited for Remote Access

A security researcher has uncovered a significant vulnerability in the Worldline Yomani XR payment terminal that could allow attackers to gain full control of the device in under a minute. The terminals are deployed in grocery stores, cafes, repair shops and other businesses across Switzerland. The maintenance port exposes an unsecured root shell, granting remote access to anyone with brief physical access.

An unpopulated debug connector on the back panel can be accessed by attaching a serial cable, after which the terminal boots and presents a login prompt on the serial console. Entering root at the prompt provides a full root shell with no password required, enabling potential malware installation, transaction data capture or movement into back-end networks.

Worldline has been notified and reportedly fixed the issue in later firmware releases, but merchants should inspect devices for unauthorized access hatches and request firmware updates that disable the external debug port.