CVE-2020-9063

NCR SelfServ ATMs running APTRA XFS 05.01.00 or earlier do not authenticate or protect the integrity of USB HID communications between the currency dispenser and the host computer, permitting an attacker with physical access to internal ATM components the ability to inject a malicious payload and execute arbitrary code with SYSTEM privileges on the host computer by causing a buffer overflow on the host.

• CWE-120
• CWE-120

• https://kb.cert.org/vuls/id/116713Third Party Advisory, US Government Resource
• https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Secure_white_paper-Dispenser_Security_Solution_September_2018.pdfExploit, Vendor Advisory
• https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-10-S1_and_S2_Critical_Update.pdfVendor Advisory
• https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_v5.pdfVendor Advisory
• https://www.ncr.com/content/dam/ncrcom/unsorted/jackpot_attacks_in_the_us_-_january_2018.pdfVendor Advisory
• https://kb.cert.org/vuls/id/116713Third Party Advisory, US Government Resource
• https://www.kb.cert.org/vuls/id/116713
• https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Secure_white_paper-Dispenser_Security_Solution_September_2018.pdfExploit, Vendor Advisory
• https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-10-S1_and_S2_Critical_Update.pdfVendor Advisory
• https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_v5.pdfVendor Advisory
• https://www.ncr.com/content/dam/ncrcom/unsorted/jackpot_attacks_in_the_us_-_january_2018.pdfVendor Advisory

Published

Aug 21, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-9057Z-Wave devices based on Silicon Labs 100, 200, and 300 serie…8.8
• CVE-2020-9058Z-Wave devices based on Silicon Labs 500 series chipsets usi…8.1
• CVE-2020-9059Z-Wave devices based on Silicon Labs 500 series chipsets usi…6.5
• CVE-2020-9060Z-Wave devices based on Silicon Labs 500 series chipsets usi…6.5
• CVE-2020-9061Z-Wave devices using Silicon Labs 500 and 700 series chipset…6.5
• CVE-2020-9062Diebold Nixdorf ProCash 2100xe USB ATMs running Wincor Proba…5.3
• CVE-2020-9064Huawei smartphone Honor V30 with versions earlier than Oxfor…5.5
• CVE-2020-9065Huawei smart phone Taurus-AL00B with versions earlier than 1…5.5
• CVE-2020-9066Huawei smartphones OxfordP-AN10B with versions earlier than …7.8
• CVE-2020-9067There is a buffer overflow vulnerability in some Huawei prod…8
• CVE-2020-9068Huawei AR3200 products with versions of V200R007C00SPC900, V…9.8
• CVE-2020-9069There is an information leakage vulnerability in some Huawei…6.5