CVE-2020-10123

The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation requests from the host computer, allowing an attacker with physical access to internal ATM components to issue valid commands to dispense currency by generating a new session key that the attacker knows.

• CWE-305
• CWE-287

• https://kb.cert.org/vuls/id/116713Third Party Advisory, US Government Resource
• https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Secure_white_paper-Dispenser_Security_Solution_September_2018.pdfExploit, Vendor Advisory
• https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-10-S1_and_S2_Critical_Update.pdfVendor Advisory
• https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_v5.pdfVendor Advisory
• https://www.ncr.com/content/dam/ncrcom/unsorted/jackpot_attacks_in_the_us_-_january_2018.pdfVendor Advisory
• https://kb.cert.org/vuls/id/116713Third Party Advisory, US Government Resource
• https://www.kb.cert.org/vuls/id/116713
• https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Secure_white_paper-Dispenser_Security_Solution_September_2018.pdfExploit, Vendor Advisory
• https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-10-S1_and_S2_Critical_Update.pdfVendor Advisory
• https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_v5.pdfVendor Advisory
• https://www.ncr.com/content/dam/ncrcom/unsorted/jackpot_attacks_in_the_us_-_january_2018.pdfVendor Advisory

Published

Aug 21, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10118cPanel before 84.0.20 allows a demo account to modify files …9.1
• CVE-2020-10119cPanel before 84.0.20 allows a demo account to achieve remot…9.8
• CVE-2020-1012<p>An elevation of privilege vulnerability exists in the way…8.8
• CVE-2020-10120cPanel before 84.0.20 allows resellers to achieve remote cod…7.2
• CVE-2020-10121cPanel before 84.0.20 allows a demo account to achieve code …9.8
• CVE-2020-10122cPanel before 84.0.20 allows a webmail or demo account to de…6.5
• CVE-2020-10124NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt,…7.1
• CVE-2020-10125NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 im…7.6
• CVE-2020-10126NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly…7.6
• CVE-2020-10128SearchBlox product with version before 9.2.1 is vulnerable t…5.4
• CVE-2020-10129SearchBlox before Version 9.2.1 is vulnerable to Privileged …8.8
• CVE-2020-1013<p>An elevation of privilege vulnerability exists when Micro…7.5