Description
Weak password requirement vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version , which allows a local user to interact with the machine where the application is installed, retrieve stored hashes from the machine and crack long 4-character passwords using a dictionary attack.
Scores
CVSS v3
5.6
EPSS
0.0004
EPSS Percentile
11.2%
Attack Vector
PHYSICAL
CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-521
Status
published
Products (2)
lamassu/douro_firmware
7.1
lamassu/douro_ii_firmware
7.1
Published
Jan 30, 2024
Tracked Since
Feb 18, 2026