NCR SelfServ ATM up to 05.01.00 APTRA XFS buffer overflow

Summaryinfo

A vulnerability has been found in NCR SelfServ ATM up to 05.01.00 and classified as critical. The affected element is an unknown function of the component APTRA XFS. This manipulation causes buffer overflow. This vulnerability is tracked as CVE-2020-9063. The attack is restricted to local execution. No exploit exists. This vulnerability has a historic impact because of its background and how it was received.

Detailsinfo

A vulnerability has been found in NCR SelfServ ATM up to 05.01.00 and classified as critical. Affected by this vulnerability is an unknown part of the component APTRA XFS. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

NCR SelfServ ATMs running APTRA XFS 05.01.00 or earlier do not authenticate or protect the integrity of USB HID communications between the currency dispenser and the host computer, permitting an attacker with physical access to internal ATM components the ability to inject a malicious payload and execute arbitrary code with SYSTEM privileges on the host computer by causing a buffer overflow on the host.

The weakness was disclosed 08/21/2020 as confirmed advisory (CERT.org). The advisory is shared at kb.cert.org. This vulnerability is known as CVE-2020-9063 since 02/18/2020. An attack has to be approached locally. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 11/04/2025). Due to its background and reception, this vulnerability has a historic impact.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry VDB-160133 is pretty similar. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• NCR

Name

• SelfServ ATM

Version

• 05.01

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion