PT-2020-20466 · Ncr · Aptra Xfs

Published 2020-08-21 · Updated 2025-11-04 · CVE-2020-9063

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NCR SelfServ ATMs running APTRA XFS versions 05.01.00 and earlier

Description The issue concerns a lack of authentication and integrity protection in USB HID communications between the currency dispenser and the host computer. This allows an attacker with physical access to internal ATM components to inject malicious payloads and execute arbitrary code with SYSTEM privileges on the host computer by causing a buffer overflow.

Recommendations For APTRA XFS versions 05.01.00 and earlier, consider restricting physical access to internal ATM components to minimize the risk of exploitation. As a temporary workaround, restrict access to the USB HID interface until a patch is available.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2020-9063

Affected Products

Aptra Xfs

References · 8

• 🔥 https://ncr.com/content/dam/ncrcom/content-type/documents/NCR_Secure_white_paper-Dispenser_Security_Solution_September_2018.pdf · Exploit
• https://ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-10-S1_and_S2_Critical_Update.pdf · Vendor Advisory
• https://ncr.com/content/dam/ncrcom/unsorted/jackpot_attacks_in_the_us_-_january_2018.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9063 · Vendor Advisory
• https://ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_v5.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9063 · Security Note
• https://kb.cert.org/vuls/id/116713 · Note
• https://t.me/cveNotify/141712 · Telegram Post