HACKING ATMS

Summary from the TLDR Cybersecurity newsletter

Synack Red Team has discovered that French company Iagona's ScrutisWeb ATM monitoring software has several vulnerabilities that could be exploited by hackers to remotely hack ATMs, including check deposit machines and payment terminals. The flaws were patched by the vendor in July 2023 with the release of ScrutisWeb version 2.1.38. The vulnerabilities include path traversal, authorization bypass, hard coded cryptographic key, and arbitrary file upload issues that can be exploited by remote, unauthenticated attackers.