CVE-2020-10125 - CVE House
Back to Database
Status published High CVE-2020-10125

NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement...

Vulnerability Description

NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software updates, which can be broken by an attacker with physical access in a sufficiently short period of time, thereby enabling the attacker to sign arbitrary files and CAB archives used to update BNA software, as well as bypass application whitelisting, resulting in the ability to execute arbitrary code.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-10125

Credits & Attribution

No credits recorded in the NVD database.

References

More from NCR

View All →
CVE-2020-9063
NCR SelfServ ATMs running APTRA XFS 05.01.00 or earlier do...
High 7.6
CVE-2020-10126
NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly...
High 7.6
CVE-2020-10124
NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt,...
High 7.1
CVE-2020-10123
The currency dispenser of NCR SelfSev ATMs running APTRA XFS...
Medium 5.3

Affected Vendor

Affected Software

SelfServ ATM
Vulnerable Versions:
APTRA XFS 04.02.01, APTRA XFS 05.01.00

Timeline

Official Publish: August 21st, 2020
Last Modified: November 4th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-326

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.