CVE-2024-0674CWE-269

Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines

Medium · published January 30, 2024

CVSS v3.1
6.3
EPSS
0%
Percentile
2.1
In the wild
Unconfirmed
What it is

Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, which could allow a local user to acquire root permissions by modifying the updatescript.js, inserting special code inside the script and creating the done.txt file. This would cause the watchdog process to run as root and execute the payload stored in the updatescript.js.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00126 · 2.1th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2024-01-30T12:19Z
EPSS history
Timeline
  • 30 JAN 12:19Z
    Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines
    cvelistv5