PT-2025-26635 · Ncr · Ncr Terminal Handler

Published 2025-06-23 · Updated 2025-06-25 · CVE-2023-47030

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: NCR Terminal Handler version 1.5.1

Description: An issue in NCR Terminal Handler allows a remote attacker to execute arbitrary code and obtain sensitive information via a GET request to a "UserService" SOAP API endpoint to validate if a user exists.

Recommendations: For NCR Terminal Handler version 1.5.1, consider disabling the UserService SOAP API endpoint until a patch is available to prevent remote code execution and sensitive information disclosure. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the UserService endpoint for user validation until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-47030

Affected Products

Ncr Terminal Handler

References · 8

• 🔥 https://github.com/pwahba/cve-research/blob/main/CVE-2023-47030/CVE-2023-47030.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-47030 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47030 · Security Note
• https://t.me/cvetracker/26869 · Telegram Post
• https://twitter.com/CVEnew/status/1937231241528639497 · Twitter Post
• https://drive.google.com/file/d/1ujUcB8XEs78WwWzs8cmD-u1Twqi10yEh/view?usp=sharing · Note
• https://twitter.com/VulmonFeeds/status/1937260802299375799 · Twitter Post
• https://t.me/cvenotify/126618 · Telegram Post