CVE-2020-10124
Last modified
CVE-2020-10124 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer, which could allow an attacker with physical access to the internal components of the ATM to execute arbitrary code, including code that enables the attacker to commit deposit forgery.. EPSS estimates a 0.73% chance of exploitation in the next 30 days.
Description
NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer, which could allow an attacker with physical access to the internal components of the ATM to execute arbitrary code, including code that enables the attacker to commit deposit forgery.
Metrics
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ncr | Aptra Xfs | 05.01.00 |
References
- https://kb.cert.org/vuls/id/815655Third Party Advisory, US Government Resource
- https://kb.cert.org/vuls/id/815655Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-10124?
How severe is CVE-2020-10124?
How do I fix CVE-2020-10124?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-10119cPanel before 84.0.20 allows a demo account to achieve remot…9.8
- CVE-2020-1012<p>An elevation of privilege vulnerability exists in the way…8.8
- CVE-2020-10120cPanel before 84.0.20 allows resellers to achieve remote cod…7.2
- CVE-2020-10121cPanel before 84.0.20 allows a demo account to achieve code …9.8
- CVE-2020-10122cPanel before 84.0.20 allows a webmail or demo account to de…6.5
- CVE-2020-10123The currency dispenser of NCR SelfSev ATMs running APTRA XFS…5.3
- CVE-2020-10125NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 im…7.6
- CVE-2020-10126NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly…7.6
- CVE-2020-10128SearchBlox product with version before 9.2.1 is vulnerable t…5.4
- CVE-2020-10129SearchBlox before Version 9.2.1 is vulnerable to Privileged …8.8
- CVE-2020-1013<p>An elevation of privilege vulnerability exists when Micro…7.5
- CVE-2020-10130SearchBlox before Version 9.1 is vulnerable to business logi…8.8
Are you affected by CVE-2020-10124?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST