Vulnerability · Published Jan 30, 2024 · Assigned by INCIBE
CVE-2024-0674Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines
Medium 6.3
In plain English
A medium-severity privilege mismanagement in Bitcoin ATM Douro machines from Lamassu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Official description
Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, which could allow a local user to acquire root permissions by modifying the updatescript.js, inserting special code inside the script and creating the done.txt file. This would cause the watchdog process to run as root and execute the payload stored in the updatescript.js.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lamassu | Bitcoin ATM Douro machines | 7.1 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H