CVE-2020-10125 affects NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00, stemming from the use of weak 512-bit RSA certificates for validating bunch note acceptor (BNA) software updates. This vulnerability carries a CVSS score of 7.6 (HIGH) due to its potential for complete compromise (C:H/I:H/A:H) once an attacker gains physical access (AV:P) to the ATM. With physical access, an attacker can break the weak RSA certificates, sign arbitrary files, bypass application whitelisting, and execute arbitrary code. While no public exploit code or active exploitation has been reported, the vulnerability has garnered some community discussion and media coverage, indicating awareness within the cybersecurity community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
04.02.01CPE matchmatch criteria | cpe:2.3:o:ncr:aptra_xfs:04.02.01:*:*:*:*:*:*:* | ||
05.01.00CPE matchmatch criteria | cpe:2.3:o:ncr:aptra_xfs:05.01.00:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.0 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.