NCR Terminal Handler Password Vulnerability Allowing Brute-Force Attacks and Account Lockout Policy Bypass

A vulnerability in NCR Terminal Handler version 1.5.1 allows remote attackers to bypass account lockout policies and conduct password brute-force attacks. This is achieved by sending crafted requests to the UserService SOAP API, specifically through the validate function, which does not properly enforce lockout or rate-limiting controls. As a result, attackers can exploit this weakness to gain unauthorized access to user accounts by overwhelming the system with login attempts, disregarding any existing security measures designed to prevent such actions.

Impact

Exploitation of this vulnerability can lead to unauthorized access to user accounts by allowing high-volume brute-force attempts, effectively circumventing any configured lockout policies.