Gabriel González

**Name of the Vulnerable Software and Affected Versions** Lamassu Bitcoin ATM Douro version 7.1 **Description** A privilege escalation issue exists, allowing a local user to gain root permissions by modifying the `updatescript.js` and creating a `done.txt` file. This causes the watchdog process to run as root, executing the payload stored in the `updatescript.js`. **Recommendations** For version 7.1, consider restricting access to the `updatescript.js` file and the watchdog process to prevent exploitation until a patch is available. As a temporary workaround, avoid using the `updatescript.js` file for updates and monitor the system for any suspicious activity related to the watchdog process.

**Name of the Vulnerable Software and Affected Versions** Lamassu Bitcoin ATM Douro version 7.1 **Description** The issue is related to improper checking for unusual or exceptional conditions in the Lamassu Bitcoin ATM Douro machines. This could allow an attacker with physical access to the ATM to escape kiosk mode, access the underlying Xwindow interface, and execute arbitrary commands as an unprivileged user. **Recommendations** For version 7.1, consider restricting physical access to the ATM to minimize the risk of exploitation. As a temporary workaround, disabling access to the underlying Xwindow interface could help mitigate the issue until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Lamassu Bitcoin ATM Douro version 7.1 **Description** The issue allows a local user to interact with the machine, retrieve stored hashes, and crack long 4-character passwords using a dictionary attack. This is due to a weak password requirement vulnerability in the affected version of the Lamassu Bitcoin ATM Douro machines. **Recommendations** For version 7.1, consider implementing stronger password requirements to prevent dictionary attacks, and restrict local user interaction with the machine to minimize the risk of exploitation. As a temporary workaround, consider disabling any features that allow the retrieval of stored hashes until a more secure solution is implemented.