Vulnerability Description
NCR SelfServ ATMs running APTRA XFS 05.01.00 or earlier do not authenticate or protect the integrity of USB HID communications between the currency dispenser and the host computer, permitting an attacker with physical access to internal ATM components the ability to inject a malicious payload and execute arbitrary code with SYSTEM privileges on the host computer by causing a buffer overflow on the host.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ncr | Aptra Xfs | <= 05.01.00 |
| Ncr | Selfserv Atm | - |
Related Weaknesses (CWE)
References
- https://kb.cert.org/vuls/id/116713Third Party AdvisoryUS Government Resource
- https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Secure_white_pExploitVendor Advisory
- https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_AlertVendor Advisory
- https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_AlertVendor Advisory
- https://www.ncr.com/content/dam/ncrcom/unsorted/jackpot_attacks_in_the_us_-_januVendor Advisory
- https://kb.cert.org/vuls/id/116713Third Party AdvisoryUS Government Resource
- https://www.kb.cert.org/vuls/id/116713
- https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Secure_white_pExploitVendor Advisory
- https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_AlertVendor Advisory
- https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_AlertVendor Advisory
- https://www.ncr.com/content/dam/ncrcom/unsorted/jackpot_attacks_in_the_us_-_januVendor Advisory
FAQ
What is CVE-2020-9063?
CVE-2020-9063 is a vulnerability with a CVSS score of 7.6 (HIGH). NCR SelfServ ATMs running APTRA XFS 05.01.00 or earlier do not authenticate or protect the integrity of USB HID communications between the currency dispenser and the host computer, permitting an attac...
How severe is CVE-2020-9063?
CVE-2020-9063 has been rated HIGH with a CVSS base score of 7.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-9063?
Check the references section above for vendor advisories and patch information. Affected products include: Ncr Aptra Xfs, Ncr Selfserv Atm.