CVE-2025-61429 Overview
CVE-2025-61429 is a privilege escalation vulnerability in NCR Atleos Terminal Manager (ConfigApp) version 3.4.0. An authenticated attacker can send a crafted request to the application and elevate privileges beyond the intended authorization boundary. The flaw is classified under [CWE-269] Improper Privilege Management and impacts the confidentiality, integrity, and availability of the affected system.
NCR Atleos Terminal Manager is used to configure and administer ATM fleets, making the ConfigApp component a high-value target for attackers seeking control of financial endpoints.
Critical Impact
A low-privileged authenticated attacker can escalate to administrative privileges over the network, gaining full control of the Terminal Manager ConfigApp and downstream ATM configuration data.
Affected Products
- NCR Atleos Terminal Manager (ConfigApp) v3.4.0
- Deployments running the vulnerable ConfigApp component
- ATM management infrastructure integrated with the affected Terminal Manager instance
Discovery Timeline
- 2025-10-29 - CVE-2025-61429 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-61429
Vulnerability Analysis
The vulnerability resides in the request handling logic of the ConfigApp component within NCR Atleos Terminal Manager v3.4.0. The application fails to correctly enforce privilege boundaries on specific requests, allowing an authenticated user with low privileges to perform actions reserved for higher-privileged roles.
Because the attack vector is network-based and requires only low privileges without user interaction, exploitation is straightforward for any user with valid credentials to the application. Successful exploitation yields high impact across confidentiality, integrity, and availability.
Public technical analysis has been published in a third-party Medium blog post describing the issue.
Root Cause
The root cause is improper privilege management [CWE-269]. The ConfigApp does not consistently validate the caller's role or authorization scope before executing privileged operations. As a result, server-side authorization checks can be bypassed by crafting a request that targets privileged endpoints or parameters normally hidden from low-privileged users.
Attack Vector
An attacker authenticates to Terminal Manager with any low-privileged account. The attacker then sends a crafted HTTP request to a ConfigApp endpoint that performs a privileged action. Because authorization checks are missing or incomplete, the server executes the request under elevated privileges. The attacker can then modify ATM configuration data, create administrative accounts, or persist access to the management plane.
No public proof-of-concept exploit code is available at this time. See the referenced technical write-up for additional details on request structure and exploitation conditions.
Detection Methods for CVE-2025-61429
Indicators of Compromise
- Unexpected creation or modification of administrative accounts inside Terminal Manager ConfigApp
- Configuration changes to ATM endpoints originating from low-privileged user sessions
- HTTP requests from standard users targeting administrative ConfigApp endpoints or parameters
- Authentication events followed immediately by privileged operations from the same session
Detection Strategies
- Enable verbose audit logging on Terminal Manager ConfigApp and correlate role of the authenticated user against the sensitivity of the action performed
- Alert on any privileged configuration change performed by an account not in the administrator role
- Baseline normal ConfigApp API usage per user role and flag deviations, especially POST/PUT requests to admin routes from non-admin sessions
Monitoring Recommendations
- Forward Terminal Manager application and web server logs to a centralized SIEM for retention and correlation
- Monitor ATM configuration repositories for unauthorized changes and use file integrity monitoring on ConfigApp server files
- Review authentication logs for accounts exhibiting sudden increases in privileged actions or access to new endpoints
How to Mitigate CVE-2025-61429
Immediate Actions Required
- Inventory all instances of NCR Atleos Terminal Manager and identify systems running ConfigApp v3.4.0
- Restrict network access to the Terminal Manager ConfigApp to trusted management networks and jump hosts only
- Rotate credentials for all Terminal Manager users and enforce multi-factor authentication where supported
- Review audit logs for signs of unauthorized privileged operations since the deployment of v3.4.0
Patch Information
No vendor advisory or fixed version is referenced in the current NVD entry. Customers should contact NCR Atleos directly to confirm patch availability for Terminal Manager (ConfigApp) v3.4.0 and to obtain remediation guidance. Refer to the Medium technical write-up for additional context while awaiting a vendor fix.
Workarounds
- Limit ConfigApp access to a minimum number of administrative users and disable inactive low-privileged accounts
- Place the Terminal Manager management interface behind a VPN or dedicated management VLAN with strict ACLs
- Deploy a web application firewall in front of ConfigApp with rules that block requests to administrative endpoints from non-admin sessions
- Increase monitoring cadence on Terminal Manager audit logs until a vendor patch is applied
# Example: restrict access to Terminal Manager ConfigApp via host firewall (Linux)
# Allow only the management subnet to reach the ConfigApp TCP port
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
