CVE-2023-47020 is a high severity cross-site request forgery chain in NCR Terminal Handler 1.5.1, scored 8.8. A crafted request can create a user and add it to an administrator group. I found no fixed version in the sources, so confirm a patch with NCR and limit who can reach the interface.
What's affected
The NVD record names NCR Terminal Handler 1.5.1 only. It describes multiple cross-site request forgery issues that chain together so an attacker can escalate privileges through a crafted request that creates a user account and adds that user to an administrator group. The record says an undisclosed function in the WSDL lacks security controls and accepts custom content types.
The only reference is a public advisory in a researcher's repository, which repeats the description, lists the vendor as NCR and the impact as privilege escalation. Neither source gives a fixed version, and I found no vendor advisory. The CPE vendor in the record is ncratleos, which suggests the product now sits under NCR Atleos, but check with NCR directly.
The vector includes user interaction, which fits the CSRF pattern: an administrator has to be signed in and visit a hostile page.
The NVD record was published on 2024-02-08, scores 8.8 (High), and carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Weakness class: CWE-352.
How to check if you're exposed
Without a published fix, exposure comes down to version and reach.
- Check whether you run Terminal Handler 1.5.1, in the product's about page or deployment records.
- Find out who can reach the management and web service interfaces, and from which networks.
- Review user and group change logs for accounts you did not create, especially new members of administrator groups.
If your records show new administrators with no matching change ticket, treat that as an incident and involve your security team.
What to do now
- Confirm with NCR whether a fixed release exists for 1.5.1 and get the advice in writing.
- Restrict the interface to a management network and require administrators to use a dedicated browser profile.
- Alert on creation of new accounts and any change to administrator group membership.
- Review current administrator accounts against your approved list.
- Plan an upgrade path so you are not left on 1.5.1.
Why it matters
CWE-352, cross-site request forgery, happens when an application accepts a state changing request from a signed-in user without checking that the user meant to send it. A page the user visits can then cause the browser to send that request with the user's session.
Here the chain ends in account creation and administrator group changes, which gives an attacker lasting access. The WSDL detail in the record suggests a service endpoint that accepts content types the web forms do not, which weakens common protections. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list.
Payment and terminal management software is a high value target, so even a user interaction requirement deserves attention.
Quick check
Does an attacker need an account?
The vector shows no privileges required but user interaction needed. A signed-in user has to be tricked into a request.
Sources
Last reviewed: 19 October 2026.
