CVE-2024-0676

Weak password requirement vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version , which allows a local user to interact with the machine where the application is installed, retrieve stored hashes from the machine and crack long 4-character passwords using a dictionary attack.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:lamassu:douro_firmware:7.1:*:*:*:*:*:*:*
cpe:2.3:h:lamassu:douro:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:lamassu:douro_ii_firmware:7.1:*:*:*:*:*:*:*
cpe:2.3:h:lamassu:douro_ii:-:*:*:*:*:*:*:*

History

08 Feb 2024, 16:39

Type Values Removed Values Added
References () https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-lamassu-bitcoin-atm-douro-machines - () https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-lamassu-bitcoin-atm-douro-machines - Third Party Advisory
CPE cpe:2.3:h:lamassu:douro:-:*:*:*:*:*:*:*
cpe:2.3:o:lamassu:douro_ii_firmware:7.1:*:*:*:*:*:*:*
cpe:2.3:h:lamassu:douro_ii:-:*:*:*:*:*:*:*
cpe:2.3:o:lamassu:douro_firmware:7.1:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.1
First Time Lamassu douro Ii
Lamassu douro Ii Firmware
Lamassu
Lamassu douro Firmware
Lamassu douro

30 Jan 2024, 14:18

Type Values Removed Values Added
New CVE

Information

Published : 2024-01-30 13:15

Updated : 2024-02-28 20:54


NVD link : CVE-2024-0676

Mitre link : CVE-2024-0676

CVE.ORG link : CVE-2024-0676


JSON object : View

Products Affected

lamassu

  • douro_firmware
  • douro_ii
  • douro
  • douro_ii_firmware
CWE
CWE-521

Weak Password Requirements