PT-2026-38910 · Cashdro 3 · Cashdro 3

Peter Gabaldon · Published 2026-05-08 · Updated 2026-05-09 · CVE-2026-8076

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CashDro 3 version 24.01.00.26

Description The web administration panel allows the use of numeric PINs for user authentication to maintain compatibility with POS software integrations deployed since 2012. This implementation enables attackers to perform brute-force attacks by attempting various PINs without triggering an account lockout. Successful exploitation can lead to unauthorized access to confidential configuration settings.

Recommendations For version 24.01.00.26, disable the use of numeric PINs for authentication or implement account lockout mechanisms to prevent brute-force attempts.

Fix

Weakness Enumeration

CWE-1391

Related Identifiers

CVE-2026-8076

Affected Products

Cashdro 3

References · 6

• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cashdro-3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-8076 · Security Note
• https://t.me/cveNotify/162700 · Telegram Post
• https://twitter.com/CVEnew/status/2053174680320708864 · Twitter Post
• https://t.me/CVEtracker/53112 · Telegram Post
• https://labs.itresit.es/2026/05/07/cashdro-vulnerabilities-from-pentest-to-stealing-money · Note