NCR SelfSev ATM 05.01.00 APTRA XFS Request authentication bypass

Summaryinfo

A vulnerability, which was classified as critical, has been found in NCR SelfSev ATM 05.01.00. The affected element is an unknown function of the component APTRA XFS. The manipulation as part of Request leads to authentication bypass. This vulnerability is listed as CVE-2020-10123. The attack must be carried out locally. There is no available exploit. This vulnerability is historically significant due to its background and the way it was received.

Detailsinfo

A vulnerability was found in NCR SelfSev ATM 05.01.00 and classified as critical. This issue affects an unknown functionality of the component APTRA XFS. The manipulation as part of a Request leads to a authentication bypass vulnerability. Using CWE to declare the problem leads to CWE-305. The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation requests from the host computer, allowing an attacker with physical access to internal ATM components to issue valid commands to dispense currency by generating a new session key that the attacker knows.

The weakness was presented 08/21/2020 as confirmed advisory (CERT.org). The advisory is shared at kb.cert.org. The identification of this vulnerability is CVE-2020-10123 since 03/05/2020. An attack has to be approached locally. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/04/2025). Due to its background and reception, this vulnerability has a historic impact.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-160177 for similar entry. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• NCR

Name

• SelfSev ATM

Version

• 05.01.00

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion