CVE-2020-10123

The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation requests from the host computer, allowing an attacker with physical access to internal ATM components to issue valid commands to dispense currency by generating a new session key that the attacker knows.

The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation requests from the host computer, allowing an attacker with physical access to internal ATM components to issue valid commands to dispense currency by generating a new session key that the attacker knows.

El dispensador de moneda de los Cajeros Automáticos NCR SelfSev que ejecutan APTRA XFS versiones 05.01.00 o anteriores, no autentica adecuadamente las peticiones de generación de claves de sesión desde el computador host, permitiendo a un atacante con acceso físico a los componentes internos del Cajero Automático emitir comandos válidos para dispensar moneda al generar una nueva clave de sesión que el atacante conoce.