CVE-2020-10123

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation requests from the host computer, allowing an attacker with physical access to internal ATM components to issue valid commands to dispense currency by generating a new session key that the attacker knows.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-305 CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Aug 21, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-101247.1NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host CVE-2020-101257.6NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software CVE-2020-101267.6NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate softare updates for the bunch note acceptor (BNA), enabling an attacke CVE-2020-101285.4SearchBlox product with version before 9.2.1 is vulnerable to stored cross-site scripting at multiple user input parameters. In SearchBlox p CVE-2020-101298.8SearchBlox before Version 9.2.1 is vulnerable to Privileged Escalation-Lower user is able to access Admin functionality.CVE-2020-10137.5<p>An elevation of privilege vulnerability exists when Microsoft Windows processes group policy updates. An attacker who successfully exploi CVE-2020-101308.8SearchBlox before Version 9.1 is vulnerable to business logic bypass where the user is able to create multiple super admin users in the syst CVE-2020-101319.8SearchBlox before Version 9.2.1 is vulnerable to CSV macro injection in "Featured Results" parameter.CVE-2020-101326.1SearchBlox before Version 9.1 is vulnerable to cross-origin resource sharing misconfiguration.CVE-2020-101346.3Pairing in Bluetooth® Core v5.2 and earlier may permit an unauthenticated attacker to acquire credentials with two pairing devices via adjac CVE-2020-101355.4Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenti CVE-2020-101365.3IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable