CVE-2020-10123 Vulnerability Details

  /     /     /  

CVE-2020-10123 Metadata Quick Info

CVE Published: 21/08/2020 | CVE Updated: 16/09/2024 | CVE Year: 2020
Source: certcc | Vendor: NCR | Product: SelfServ ATM
Status : PUBLISHED

---

CVE-2020-10123 Description

The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation requests from the host computer, allowing an attacker with physical access to internal ATM components to issue valid commands to dispense currency by generating a new session key that the attacker knows.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-305
CWE Name: CWE-305 Authentication Bypass by Primary Weakness
Source: NCR

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).