CVE-2026-8076
Weak credentials vulnerability in the CashDro 3 web administration panel
Description
Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of numeric PINs for user authentication. The system supports the use of PIN-based credentials, maintaining compatibility with POS software integrations deployed since 2012. This could allow an attacker to easily perform a brute-force attack against a user and gain access by trying different PINs without the account being locked. Successful exploitation of this vulnerability could result in unauthorized access to confidential configuration settings, compromising the security of the system.
INFO
Published Date :
May 8, 2026, 12:16 p.m.
Last Modified :
Oct. 26, 2026, 7:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | CRITICAL | 0cbda920-cd7f-484a-8e76-bf7f4b7f4516 | ||||
| CVSS 4.0 | CRITICAL | [email protected] |
Solution
- Implement strong, non-numeric credentials.
- Configure account lockout after failed attempts.
- Update firmware to the latest version.
- Review and restrict access to admin panel.
Public PoC/Exploit Available at Github
CVE-2026-8076 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-8076.
| URL | Resource |
|---|---|
| https://labs.itresit.es/2026/05/07/cashdro-vulnerabilities-from-pentest-to-stealing-money/ | |
| https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cashdro-3 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-8076 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-8076
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
My GitHub profile README — a neofetch-style colored ASCII-art card for a cybersecurity engineer
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-8076 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-8076 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 26, 2026
Action Type Old Value New Value Added Translation Title: CashDro 3 Administration Panel de CashDro, Description: Credenciales débiles en el panel de administración web de CashDro 3, versión 24.01.00.26, donde la plataforma permite el uso de PINs numéricos para la autenticación de usuarios. El sistema soporta el uso de credenciales basadas en PIN, manteniendo compatibilidad con integraciones de software POS desplegadas desde 2012. Esto podría permitir a un atacante realizar fácilmente un ataque de fuerza bruta contra un usuario y obtener acceso probando diferentes PINs sin que la cuenta sea bloqueada. La explotación exitosa de esta vulnerabilidad podría resultar en acceso no autorizado a configuraciones confidenciales, comprometiendo la seguridad del sistema. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'CashDro', 'product': 'CashDro 3 Administration Panel', 'versions': [{'status': 'affected', 'version': '24.01.00.26'}], 'defaultStatus': 'unaffected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-8076', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-05-08T12:48:14.064906Z'} -
CVE Modified by [email protected]
May. 08, 2026
Action Type Old Value New Value Added Reference https://labs.itresit.es/2026/05/07/cashdro-vulnerabilities-from-pentest-to-stealing-money/ -
New CVE Received by [email protected]
May. 08, 2026
Action Type Old Value New Value Added Description Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of numeric PINs for user authentication. The system supports the use of PIN-based credentials, maintaining compatibility with POS software integrations deployed since 2012. This could allow an attacker to easily perform a brute-force attack against a user and gain access by trying different PINs without the account being locked. Successful exploitation of this vulnerability could result in unauthorized access to confidential configuration settings, compromising the security of the system. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-1391 Added Reference https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cashdro-3