CVE-2026-8076

Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of numeric PINs for user authentication. The system supports the use of PIN-based credentials, maintaining compatibility with POS software integrations deployed since 2012. This could allow an attacker to easily perform a brute-force attack against a user and gain access by trying different PINs without the account being locked. Successful exploitation of this vulnerability could result in unauthorized access to confidential configuration settings, compromising the security of the system.

CVSS

No CVSS.

References

Link	Resource
https://labs.itresit.es/2026/05/07/cashdro-vulnerabilities-from-pentest-to-stealing-money/
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cashdro-3

Configurations

No configuration.

History

26 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Credenciales débiles en el panel de administración web de CashDro 3, versión 24.01.00.26, donde la plataforma permite el uso de PINs numéricos para la autenticación de usuarios. El sistema soporta el uso de credenciales basadas en PIN, manteniendo compatibilidad con integraciones de software POS desplegadas desde 2012. Esto podría permitir a un atacante realizar fácilmente un ataque de fuerza bruta contra un usuario y obtener acceso probando diferentes PINs sin que la cuenta sea bloqueada. La explotación exitosa de esta vulnerabilidad podría resultar en acceso no autorizado a configuraciones confidenciales, comprometiendo la seguridad del sistema.

Information

Published : 2026-05-08 12:16

Updated : 2026-10-26 19:10

NVD link : CVE-2026-8076

Mitre link : CVE-2026-8076

CVE.ORG link : CVE-2026-8076

JSON object : View

Products Affected

No product.

CWE

CWE-1391

Use of Weak Credentials

{"id": "CVE-2026-8076", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8076", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-08T12:48:14.064906Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve-coordination@incibe.es", "affectedData": [{"vendor": "CashDro", "product": "CashDro 3 Administration Panel", "versions": [{"status": "affected", "version": "24.01.00.26"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-08T12:16:29.560", "references": [{"url": "https://labs.itresit.es/2026/05/07/cashdro-vulnerabilities-from-pentest-to-stealing-money/", "source": "cve-coordination@incibe.es"}, {"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cashdro-3", "source": "cve-coordination@incibe.es"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-1391"}]}], "descriptions": [{"lang": "en", "value": "Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of numeric PINs for user authentication. The system supports the use of PIN-based credentials, maintaining compatibility with POS software integrations deployed since 2012. This could allow an attacker to easily perform a brute-force attack against a user and gain access by trying different PINs without the account being locked. Successful exploitation of this vulnerability could result in unauthorized access to confidential configuration settings, compromising the security of the system."}, {"lang": "es", "value": "Credenciales d\u00e9biles en el panel de administraci\u00f3n web de CashDro 3, versi\u00f3n 24.01.00.26, donde la plataforma permite el uso de PINs num\u00e9ricos para la autenticaci\u00f3n de usuarios. El sistema soporta el uso de credenciales basadas en PIN, manteniendo compatibilidad con integraciones de software POS desplegadas desde 2012. Esto podr\u00eda permitir a un atacante realizar f\u00e1cilmente un ataque de fuerza bruta contra un usuario y obtener acceso probando diferentes PINs sin que la cuenta sea bloqueada. La explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda resultar en acceso no autorizado a configuraciones confidenciales, comprometiendo la seguridad del sistema."}], "lastModified": "2026-10-26T19:10:00.163", "sourceIdentifier": "cve-coordination@incibe.es"}