Vulnerability · Published Aug 21, 2020 · Assigned by certcc

CVE-2020-9062

Medium 5.3

In plain English

A medium-severity missing authentication in ProCash 2100xe USB ATM from Diebold Nixdorf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS NVD)5.3Medium

Exploit odds (30 days)0.2%top 93.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Diebold Nixdorf ProCash 2100xe USB ATMs running Wincor Probase version 1.1.30 do not encrypt, authenticate, or verify the integrity of messages between the CCDM and the host computer, allowing an attacker with physical access to internal ATM components to commit deposit forgery by intercepting and modifying messages to the host computer, such as the amount and value of currency being deposited.

Affected products (as reported)

Vendor	Product	Versions
Diebold Nixdorf	ProCash 2100xe USB ATM	Wincor Probase 1.1.30

Weakness: CWE-353, CWE-306, CWE-311

References

https://kb.cert.org/vuls/id/221785 x_refsource_MISC
https://www.kb.cert.org/vuls/id/221785