CVE-2026-8076: CashDro 3 Web Admin Panel Weak PIN Authentication Vulnerability
CVE-2026-8076 affects the web administration panel of CashDro 3, version 24.01.00.26, which accepts numeric PINs for user authentication. The record describes the lack of account lockout as allowing brute-force guessing of PINs, with possible access to confidential configuration settings. The CNA rated it critical with CVSS 4.0 score 9.3, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-8076 describes weak credentials in the web administration panel of CashDro 3, version 24.01.00.26. The platform accepts numeric PINs for user authentication, and the record states that this design was kept for compatibility with POS software integrations deployed since 2012. The CNA is INCIBE-CERT's coordination contact.
Impact
The record states that an attacker could brute-force a user's PIN without the account being locked, which could lead to unauthorized access to confidential configuration settings. The CVSS 4.0 vector indicates network reachability, no privileges or user interaction required, and high confidentiality and integrity impact. Availability impact is rated none.
Affected products and versions
- Product: CashDro 3 web administration panel.
- Version listed in the record: 24.01.00.26.
The record does not include a structured list of affected or fixed versions, so the full version range is unknown from this data.
Exploitation status
The CISA KEV catalog does not list this CVE in the record. No confirmed active exploitation appears in the sources consulted.
Remediation and mitigation
- Review whether the CashDro 3 web administration panel is reachable from untrusted networks and restrict access to management interfaces.
- Check the vendor or the INCIBE-CERT notice for an updated release or configuration guidance; the record does not state a fixed version.
- Where PIN-based authentication is used for POS integrations, assess dependencies before changing authentication settings.
- Enforce strong, unique credentials and monitor administrative access for unusual activity.
Detection guidance
- Review authentication logs of the administration panel for repeated failed logins against the same account.
- Alert on successful logins following many failures, and on administrative configuration changes from unfamiliar sources.
Limitations of the available information
The record does not provide CWE name details beyond the identifier, a list of affected or fixed versions, or vendor patch details. The sources consulted are a third-party penetration testing write-up and an INCIBE-CERT notice; their full content was not available in the record.
Frequently asked questions
What is CVE-2026-8076?
It is a weak credential issue in the CashDro 3 web administration panel, version 24.01.00.26, where numeric PINs are accepted for user authentication and accounts are not locked after repeated attempts, according to the record.
What is the severity?
The CNA assigned a CVSS 4.0 base score of 9.3 and a critical severity rating. The record does not provide other scores.
Is it being actively exploited?
The CISA KEV catalog does not list this CVE in the record, and no confirmed active exploitation appears in the sources consulted.
Is a fixed version available?
The record does not list fixed versions. Check the vendor or the INCIBE-CERT notice for update guidance.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.