Riskcovery

CVE-2020-10125

State
Published
Severity
Not scored
Published
Aug 21, 2020
Updated
Nov 4, 2025
Reserved
Mar 5, 2020

Read the record on cve.org

Description

NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software updates, which can be broken by an attacker with physical access in a sufficiently short period of time, thereby enabling the attacker to sign arbitrary files and CAB archives used to update BNA software, as well as bypass application whitelisting, resulting in the ability to execute arbitrary code.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-326 Inadequate Encryption Strength

Affected Products

ProductVersions
SelfServ ATMNCR
  • APTRA XFS 04.02.01Affected
  • APTRA XFS 05.01.00Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.