CVE-2020-10124

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer, which could allow an attacker with physical access to the internal components of the ATM to execute arbitrary code, including code that enables the attacker to commit deposit forgery.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-306 CWE-311 CWE-353 CWE-319

Affected software

Vendor	Product	Versions
NCR	SelfServ ATM	APTRA XFS 05.01.00

References

https://kb.cert.org/vuls/id/815655Third Party Advisory, US Government Resource
https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_Broken Link
https://kb.cert.org/vuls/id/815655Third Party Advisory, US Government Resource
https://www.kb.cert.org/vuls/id/815655
https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_Broken Link

Timeline

Published: Aug 21, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-101257.6NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software CVE-2020-101267.6NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate softare updates for the bunch note acceptor (BNA), enabling an attacke CVE-2020-101285.4SearchBlox product with version before 9.2.1 is vulnerable to stored cross-site scripting at multiple user input parameters. In SearchBlox p CVE-2020-101298.8SearchBlox before Version 9.2.1 is vulnerable to Privileged Escalation-Lower user is able to access Admin functionality.CVE-2020-10137.5<p>An elevation of privilege vulnerability exists when Microsoft Windows processes group policy updates. An attacker who successfully exploi CVE-2020-101308.8SearchBlox before Version 9.1 is vulnerable to business logic bypass where the user is able to create multiple super admin users in the syst CVE-2020-101319.8SearchBlox before Version 9.2.1 is vulnerable to CSV macro injection in "Featured Results" parameter.CVE-2020-101326.1SearchBlox before Version 9.1 is vulnerable to cross-origin resource sharing misconfiguration.CVE-2020-101346.3Pairing in Bluetooth® Core v5.2 and earlier may permit an unauthenticated attacker to acquire credentials with two pairing devices via adjac CVE-2020-101355.4Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenti CVE-2020-101365.3IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable CVE-2020-101376.5Z-Wave devices based on Silicon Labs 700 series chipsets using S2 do not adequately authenticate or encrypt FIND_NODE_IN_RANGE frames, allow