PT-2025-26603 · Ncr · Ncr Terminal Handler

Published 2025-06-23 · Updated 2025-06-23 · CVE-2023-47298

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: NCR Terminal Handler version 1.5.1

Description: An issue allows a low-level privileged authenticated attacker to query the SOAP API endpoint to obtain information about all of the users of the application, including their usernames, roles, security groups, and account statuses.

Recommendations: For NCR Terminal Handler version 1.5.1, consider restricting access to the SOAP API endpoint to minimize the risk of exploitation. As a temporary workaround, limit the privileges of low-level authenticated attackers to prevent them from querying sensitive user information.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-47298

Affected Products

Ncr Terminal Handler

References · 7

• 🔥 https://github.com/pwahba/cve-research/blob/main/CVE-2023-47298/CVE-2023-47298.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-47298 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47298 · Security Note
• https://drive.google.com/file/d/1-BDd0ycuYhuxo-lg4th-Cswimoqqzkot/view?usp=sharing · Note
• https://twitter.com/CVEnew/status/1937159298624184698 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1937196807894774272 · Twitter Post
• https://t.me/cvetracker/26837 · Telegram Post