PT-2020-11945 · Ncr · Aptra Xfs+1

Maxim Kozorez · Published 2020-08-21 · Updated 2025-11-04 · CVE-2020-10123

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions NCR SelfSev ATMs running APTRA XFS version 05.01.00 or earlier

Description The issue concerns inadequate authentication of session key generation requests from the host computer in the currency dispenser of NCR SelfSev ATMs. This allows an attacker with physical access to internal ATM components to issue valid commands to dispense currency by generating a new session key that the attacker knows.

Recommendations For NCR SelfSev ATMs running APTRA XFS version 05.01.00 or earlier, consider restricting physical access to internal ATM components to minimize the risk of exploitation. As a temporary workaround, review and enhance the authentication process for session key generation requests from the host computer until a more permanent fix is available.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-305

Related Identifiers

CVE-2020-10123

Affected Products

Aptra Xfs

Ncr Selfserv Atms

References · 8

• 🔥 https://ncr.com/content/dam/ncrcom/content-type/documents/NCR_Secure_white_paper-Dispenser_Security_Solution_September_2018.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2020-10123 · Vendor Advisory
• https://ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-10-S1_and_S2_Critical_Update.pdf · Vendor Advisory
• https://ncr.com/content/dam/ncrcom/unsorted/jackpot_attacks_in_the_us_-_january_2018.pdf · Vendor Advisory
• https://ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_v5.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10123 · Security Note
• https://kb.cert.org/vuls/id/116713 · Note
• https://t.me/cveNotify/141708 · Telegram Post