PT-2024-15739 · Lamassu · Lamassu Bitcoin Atm Douro

Gabriel González · Published 2024-01-30 · Updated 2024-02-08 · CVE-2024-0675

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lamassu Bitcoin ATM Douro version 7.1

Description The issue is related to improper checking for unusual or exceptional conditions in the Lamassu Bitcoin ATM Douro machines. This could allow an attacker with physical access to the ATM to escape kiosk mode, access the underlying Xwindow interface, and execute arbitrary commands as an unprivileged user.

Recommendations For version 7.1, consider restricting physical access to the ATM to minimize the risk of exploitation. As a temporary workaround, disabling access to the underlying Xwindow interface could help mitigate the issue until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2024-0675

Affected Products

Lamassu Bitcoin Atm Douro

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-0675 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0675 · Vendor Advisory
• https://t.me/cvenotify/69199 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-lamassu-bitcoin-atm-douro-machines · Note
• https://twitter.com/CVEnew/status/1752312646362075626 · Twitter Post