CVE-2024-0676 is a medium severity weak password requirement in Lamassu Bitcoin ATM Douro machines running version 7.1, scored 5.6. INCIBE-CERT says the issue is resolved in versions 8.1.5-1 and 8.1.6. Update the machines and review who knows local credentials on them.
What's affected
NVD lists the Douro and Douro II firmware at 7.1. The INCIBE-CERT notice groups this CVE with two others for the same product line, CVE-2024-0674 and CVE-2024-0675, and states the issues are resolved in 8.1.5-1 and 8.1.6. The notice spells the product Douru in its affected list.
The vector is CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. The attacker needs physical access and a low privilege account, and the effect is high on confidentiality and integrity with no effect on availability. The weakness class is CWE-521, weak password requirements. INCIBE lists this CVE at 5.6, the same as NVD, and rates the group as medium.
How to check if you're exposed
Read the firmware version on each machine from its admin interface or from your fleet records. Version 7.1 is in scope. Versions 8.1.5-1 and 8.1.6 are the ones the advisory names as resolving the problem.
Beyond version, look at your own credential practice. The record says the weakness lets a local user retrieve stored hashes and crack passwords that are only four characters long using a dictionary attack. If your technicians chose short local passwords on any machine, change them after the update, because the old hashes may already have been copied.
What to do now
- Find every Douro and Douro II machine still on 7.1.
- Update to 8.1.5-1 or 8.1.6 as INCIBE-CERT recommends.
- After updating, reset local passwords to long, unique values and store them in your password manager.
- Limit who can physically open or connect to the machines.
- Check the vendor's 26 October 2023 security update article linked in the INCIBE notice for any extra steps.
Why it matters
Password hashes slow an attacker down only if the passwords behind them are hard to guess. A four character password falls to a dictionary attack in very little time, so the hash gives almost no protection once someone can read it. The record frames the attack as local: the person has to be at the machine and able to read where the hashes are stored.
That keeps the risk contained, but it also stacks with the other two CVEs in the advisory. A local foothold from one weakness plus guessable credentials from another is how small issues turn into a larger incident. The record does not mark this CVE as known exploited.
If the affected component is something your own code pulls in as a dependency, the free in-browser dependency scan at gold.safeguard.sh/scan will tell you whether it appears in your manifests. Reachability analysis then helps you separate the copies that your code actually exercises from the ones that only sit in the tree.
Quick check
Does a long password fix the root problem?
It limits the damage from this weakness, but the advisory's fix is the firmware update. Do both.
Is this the same as CVE-2024-0674?
No. They share a product and an advisory. CVE-2024-0674 is about privilege escalation through the update script, while this one is about weak password requirements.
Sources
Last reviewed: 19 October 2026.
