title: Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines
description: Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, which could allow a local user to acquire root permissions by modifying the updatescript.js, inserting special code inside the script and creating the done.txt file. This would cause the watchdog process to run as root and execute the payload stored in the updatescript.js.
problem types: CWE-269 Improper Privilege Management
affected:
{
defaultStatus: unaffected
product: Bitcoin ATM Douro machines
vendor: Lamassu
versions:
status: affected, version: 7.1
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: The vulnerabilities have been resolved in version 8.1.5-1 and 8.1.6.