CVE-2024-0676

low-risk

Published 2024-01-30

Weak password requirement vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version , which allows a local user to interact with the machine where the application is installed, retrieve stored hashes from the machine and crack long 4-character passwords using a dictionary attack.

Do I need to act?

0.04% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.6/10 Medium

PHYSICAL / HIGH complexity

Affected Products (2)

Douro Firmware

Douro Ii Firmware

Affected Vendors

Lamassu

References (2)

Third Party Advisory https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-lama...

/ 100

low-risk

Severity 15/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 7/34 · Low