Lucene search

K
nvd[email protected]NVD:CVE-2024-0675
HistoryJan 30, 2024 - 1:15 p.m.

CVE-2024-0675

2024-01-3013:15:08
CWE-754
web.nvd.nist.gov
cve-2024-0675
improper checking
lamassu bitcoin atm
physical access
kiosk mode
xwindow interface
arbitrary commands
unprivileged user

6.8 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.7%

Vulnerability of improper checking for unusual or exceptional conditions

in Lamassu Bitcoin ATM Douro machines, in its 7.1 version,

the exploitation of which could allow an attacker with physical access to the ATM to escape kiosk mode, access the underlying Xwindow interface and execute arbitrary commands as an unprivileged user.

Affected configurations

NVD
Node
lamassudouro_firmwareMatch7.1
AND
lamassudouroMatch-
Node
lamassudouro_ii_firmwareMatch7.1
AND
lamassudouro_iiMatch-

6.8 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.7%

Related for NVD:CVE-2024-0675