Medium severity5.3NVD Advisory· Published Aug 21, 2020· Updated Jun 17, 2026

CVE-2020-10123

Description

The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation requests from the host computer, allowing an attacker with physical access to internal ATM components to issue valid commands to dispense currency by generating a new session key that the attacker knows.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Ncr/Aptra Xfs2 versions
cpe:2.3:o:ncr:aptra_xfs:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:ncr:aptra_xfs:*:*:*:*:*:*:*:*range: <=05.01.00
- (no CPE)range: <=05.01.00
Ncr/SelfServ ATMscpe-rescue
Range: APTRA XFS

Patches

Vulnerability mechanics

References

www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Secure_white_paper-Dispenser_Security_Solution_September_2018.pdfnvdExploitVendor Advisory
kb.cert.org/vuls/id/116713nvdThird Party AdvisoryUS Government Resource
www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-10-S1_and_S2_Critical_Update.pdfnvdVendor Advisory
www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_v5.pdfnvdVendor Advisory
www.ncr.com/content/dam/ncrcom/unsorted/jackpot_attacks_in_the_us_-_january_2018.pdfnvdVendor Advisory
www.kb.cert.org/vuls/id/116713nvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000