CVE-2024-0674 is a medium severity local privilege escalation in Lamassu Douro Bitcoin ATM machines running version 7.1, scored 6.3. INCIBE-CERT reports that versions 8.1.5-1 and 8.1.6 resolve it. Operators should update affected machines and read the vendor's October 2023 security update article.
What's affected
The NVD record covers the Douro and Douro II firmware at version 7.1. INCIBE-CERT published the notice as one advisory covering three CVEs for Lamassu Douro machines, and it spells the product Douru in its list. Its stated fix is: resolved in version 8.1.5-1 and 8.1.6.
The vector is CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Physical access is required, complexity is high and the attacker needs a low privilege account on the machine. If those conditions are met, the effect on confidentiality, integrity and availability is high. The weaknesses are CWE-269 (improper privilege management) and CWE-281 (improper preservation of permissions).
The advisory rates the group at medium, importance 3, and all three CVEs at CVSS 3.1 medium. The NVD score for this CVE is 6.3, so the two sources agree.
How to check if you're exposed
This is firmware on a physical kiosk, so there is no package manager command. Check the software version displayed in the machine's administration interface or in your fleet inventory, and compare it with 8.1.5-1 and 8.1.6. Anything still on 7.1 is in scope.
Your operator records are the quickest route. List each machine, its location, who can physically reach its internal compartment, and the installed version. The advisory does not describe any interim mitigation beyond updating, so version is the deciding fact.
What to do now
- Inventory every Douro and Douro II machine and its firmware version.
- Schedule the update to 8.1.5-1 or 8.1.6 for machines on 7.1, starting with the ones in the least supervised locations.
- Read the vendor's Security update for Douros article from 26 October 2023, which INCIBE links.
- Review physical access controls on the machine housings and who holds service credentials.
- Record the update in your change log so you can show which machines were covered and when.
Why it matters
The record explains the mechanism at a high level. A local user can modify a script used in the update process, add content to it, and create a marker file. That causes a watchdog process to run with root rights and execute what the script contains. In plain terms, a process with high privilege trusts a file that a lower privilege user can change.
That pattern is common in appliances and kiosks. It matters most where several people can reach the device, such as technicians, cleaners and outside contractors. An ATM stores cash and talks to financial systems, so even a local flaw deserves a planned fix.
The record does not list this CVE as known exploited, and nothing in the advisory says it has been used in attacks.
If the affected component is something your own code pulls in as a dependency, the free in-browser dependency scan at gold.safeguard.sh/scan will tell you whether it appears in your manifests. Reachability analysis then helps you separate the copies that your code actually exercises from the ones that only sit in the tree.
Quick check
Do I need physical access to exploit this?
Yes. The vector is physical and the attack complexity is high, so it is a risk for machines that people other than your staff can open or connect to.
Which versions fix it?
INCIBE-CERT states that 8.1.5-1 and 8.1.6 resolve the issue. Confirm with the vendor article before rolling out.
Sources
Last reviewed: 19 October 2026.
