PT-2017-3752 · Ncr · Ncr S1 Dispenser Controller

Aleksey Stennikov + 2 · Published 2017-06-23 · Updated 2019-10-03 · CVE-2017-17668

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions: NCR S1 Dispenser controller versions prior to 0x0156

Description: The issue is related to the memory write mechanism in the NCR S1 Dispenser controller, which lacks sufficient protection. This allows an unauthenticated user to upgrade or downgrade the firmware of the device, including to older versions with known vulnerabilities. Exploitation of this issue may enable a remote attacker to execute arbitrary code or downgrade the device's firmware to an outdated version with known vulnerabilities.

Recommendations: For versions prior to 0x0156, update the firmware to version 0x0156 or later to resolve the issue. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation.

Fix

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-863

Related Identifiers

BDU:2019-00309

CVE-2017-17668

Affected Products

Ncr S1 Dispenser Controller

References · 5

• https://bdu.fstec.ru/vul/2019-00309 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-17668 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17668 · Vendor Advisory
• https://ncr.com/sites/default/files/ncr_security_alert_-_2018-04_v3.pdf · Vendor Advisory
• https://ptsecurity.com/ru-ru/research/threatscape/pt-2018-32 · Note