CVE-2024-0674

Katalog CVE

CVSS 7.8 · High EPSS 0,13%

Kerentanan Improper Privilege Management pada lamassu douro firmware, lamassu douro ii firmware. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, which could allow a local user to acquire root permissions by modifying the updatescript.js, inserting special code inside the script and creating the done.txt file. This would cause the watchdog process to run as root and execute the payload stored in the updatescript.js.

Rincian

Terbit di NVD

30 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management
CWE-281: Improper Preservation of Permissions

EPSS (30 hari)

0,13% peluang dieksploitasi; lebih tinggi dari 2,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-lamassu-bitcoin-atm-douro-machines advisory pihak ketiga