CVE-2023-47024 is a high severity cross-site request forgery flaw in NCR Terminal Handler 1.5.1, scored 8.8. The record says it leads to one-click account takeover. I found no fixed version in the sources, so ask NCR for a patch and restrict who can reach the interface in the meantime.
What's affected
The record names NCR Terminal Handler 1.5.1 and says cross-site request forgery leads to one-click account takeover. It adds that the result comes from several weaknesses, including an undisclosed function in the WSDL with weak security controls that accepts custom content types.
This is the sibling of CVE-2023-47020, published by the same researcher against the same version. That entry focuses on creating an administrator account. This one focuses on taking over an existing account.
The references are a public advisory in a researcher's repository and a shared document. The repository text lists the impact as account takeover. Neither gives a fixed version, and I found no NCR advisory. Treat all of 1.5.1 as affected.
The NVD record was published on 2024-01-20, scores 8.8 (High), and carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Weakness class: CWE-352.
How to check if you're exposed
Check the version and the reach of the interface, then look for signs of account changes.
- Confirm whether you run Terminal Handler 1.5.1.
- List which networks and which people can open the web and service interfaces.
- Review authentication logs for password or email changes you did not expect, and for sign-ins from new locations.
If a user reports being locked out or sees changed details, escalate quickly.
What to do now
- Ask NCR for the fixed release and its date, and record the answer.
- Limit access to the interface by network, and keep administrators on a separate browser profile.
- Enforce multi-factor authentication for administrator accounts if the product supports it.
- Review recent account detail changes and reset credentials where anything looks wrong.
- Schedule the upgrade away from 1.5.1.
Why it matters
The class is CWE-352. Browsers attach session cookies to requests automatically, so a site that does not verify intent can be driven by another page. A single click on a crafted link is enough.
The record's mention of custom content types matters because many CSRF protections rely on the browser refusing to send certain types cross-site. An endpoint that accepts unusual types can sidestep those habits. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list.
The practical lesson is to check every state changing endpoint, including service interfaces behind the web UI.
Quick check
How does this differ from CVE-2023-47020?
Both affect Terminal Handler 1.5.1 and use CSRF. The first is described as privilege escalation through account creation, this one as account takeover.
Sources
Last reviewed: 19 October 2026.
