Vulnerability Description
The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation requests from the host computer, allowing an attacker with physical access to internal ATM components to issue valid commands to dispense currency by generating a new session key that the attacker knows.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ncr | Aptra Xfs | <= 05.01.00 |
| Ncr | Selfserv Atm | - |
Related Weaknesses (CWE)
References
- https://kb.cert.org/vuls/id/116713Third Party AdvisoryUS Government Resource
- https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Secure_white_pExploitVendor Advisory
- https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_AlertVendor Advisory
- https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_AlertVendor Advisory
- https://www.ncr.com/content/dam/ncrcom/unsorted/jackpot_attacks_in_the_us_-_januVendor Advisory
- https://kb.cert.org/vuls/id/116713Third Party AdvisoryUS Government Resource
- https://www.kb.cert.org/vuls/id/116713
- https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Secure_white_pExploitVendor Advisory
- https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_AlertVendor Advisory
- https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_AlertVendor Advisory
- https://www.ncr.com/content/dam/ncrcom/unsorted/jackpot_attacks_in_the_us_-_januVendor Advisory
FAQ
What is CVE-2020-10123?
CVE-2020-10123 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation requests from the host computer, allowing an attacker with phys...
How severe is CVE-2020-10123?
CVE-2020-10123 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-10123?
Check the references section above for vendor advisories and patch information. Affected products include: Ncr Aptra Xfs, Ncr Selfserv Atm.