CVE-2024-0676

Weak password requirement vulnerability 

in Lamassu Bitcoin ATM Douro machines, in its 7.1 version

, which allows a local user to interact with the machine where the application is installed, retrieve stored hashes from the machine and crack long 4-character passwords using a dictionary attack.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.6 MEDIUM
PHYSICAL
HIGH
LOW
CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
INCIBECNA
5.6 MEDIUM
PHYSICAL
HIGH
LOW
CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 4%
VendorProductVersion
lamassudouro_firmware
7.1
lamassudouro_ii_firmware
7.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-lamassu-bitcoin-atm-douro-machines
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-lamassu-bitcoin-atm-douro-machines