VulnerabilityModified
CVE-2017-17668
Memory write mechanism in NCR S1 Dispenser controller before firmware version 0x0156 allows an unauthenticated user to upgrade or downgrade the firmware of the device, including to older versions with known vulnerabilities.
HIGH 7.5EPSS 1.15%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Memory write mechanism in NCR S1 Dispenser controller before firmware version 0x0156 allows an unauthenticated user to upgrade or downgrade the firmware of the device, including to older versions with known vulnerabilities.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 1.15% probability · 65th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-863
- Affected
- ncr/s1 dispenser controller firmware
- Source
- cve@mitre.org
References
- https://www.ncr.com/sites/default/files/ncr_security_alert_-_2018-04_v3.pdfBroken Link, Vendor Advisory
- https://www.ncr.com/sites/default/files/ncr_security_alert_-_2018-04_v3.pdfBroken Link, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.