The CashDro 3 Administration Panel version 24.01.00.26 supports numeric PIN-based authentication to maintain compatibility with legacy POS integrations. This design choice introduces a vulnerability (CVE-2026-8076) where weak credentials can be brute-forced without triggering account lockout or other protections. The absence of such controls allows attackers to attempt multiple PIN combinations to gain unauthorized access to the administration panel, potentially compromising system configuration and security. The CVSS 4.0 score of 9.3 reflects the high impact and ease of exploitation due to network attack vector, no required privileges or user interaction, and high confidentiality and integrity impacts.

Successful exploitation of this vulnerability allows an attacker to bypass authentication by brute-forcing weak numeric PINs, leading to unauthorized access to sensitive administrative settings. This can compromise the confidentiality and integrity of the system's configuration, potentially affecting the security and operation of the CashDro 3 platform. There is no indication of availability impact or requirement for privileges, making the threat significant in remote attack scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider implementing compensating controls such as restricting network access to the administration panel, monitoring for brute-force attempts, and enforcing stronger authentication mechanisms if configurable. Avoid relying solely on PIN-based authentication where possible.