CVE-2020-10126 - CVE House
Back to Database
Status published High CVE-2020-10126

NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly...

Vulnerability Description

NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate softare updates for the bunch note acceptor (BNA), enabling an attacker with physical access to internal ATM components to restart the host computer and execute arbitrary code with SYSTEM privileges because while booting, the update process looks for CAB archives on removable media and executes a specific file without first validating the signature of the CAB archive.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-10126

Credits & Attribution

No credits recorded in the NVD database.

References

More from NCR

View All →
CVE-2020-9063
NCR SelfServ ATMs running APTRA XFS 05.01.00 or earlier do...
High 7.6
CVE-2020-10125
NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement...
High 7.6
CVE-2020-10124
NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt,...
High 7.1
CVE-2020-10123
The currency dispenser of NCR SelfSev ATMs running APTRA XFS...
Medium 5.3

Affected Vendor

Affected Software

SelfServ ATM
Vulnerable Versions:
APTRA XFS 05.01.00

Timeline

Official Publish: August 21st, 2020
Last Modified: November 4th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-305

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.