CVE-2024-0674
Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.3EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
30 Jan 2024Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, which could allow a local user to acquire root permissions by modifying the updatescript.js, inserting special code inside the script and creating the done.txt file. This would cause the watchdog process to run as root and execute the payload stored in the updatescript.js.
CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Lamassu · Bitcoin ATM Douro machinesWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →