CVE-2020-10125

Severity: high (CVSS 7.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-08-21 · updated 2026-06-17
Weakness: CWE-326

Description

NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software updates, which can be broken by an attacker with physical access in a sufficiently short period of time, thereby enabling the attacker to sign arbitrary files and CAB archives used to update BNA software, as well as bypass application whitelisting, resulting in the ability to execute arbitrary code.

Affected products

NCR Aptra Xfs: 04.02.01, 05.01.00

References

https://kb.cert.org/vuls/id/815655
https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_
https://kb.cert.org/vuls/id/815655
https://www.kb.cert.org/vuls/id/815655
https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_

Get alerted when CVE-2020-10125 or the next vulnerability affects your stack