CVE-2020-10125

NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software updates, which can be broken by an attacker with physical access in a sufficiently short period of time, thereby enabling the attacker to sign arbitrary files and CAB archives used to update BNA software, as well as bypass application whitelisting, resulting in the ability to execute arbitrary code.

• CWE-326
• CWE-326

• https://kb.cert.org/vuls/id/815655Third Party Advisory, US Government Resource
• https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_Broken Link
• https://kb.cert.org/vuls/id/815655Third Party Advisory, US Government Resource
• https://www.kb.cert.org/vuls/id/815655
• https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_Broken Link

Published

Aug 21, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1012<p>An elevation of privilege vulnerability exists in the way…8.8
• CVE-2020-10120cPanel before 84.0.20 allows resellers to achieve remote cod…7.2
• CVE-2020-10121cPanel before 84.0.20 allows a demo account to achieve code …9.8
• CVE-2020-10122cPanel before 84.0.20 allows a webmail or demo account to de…6.5
• CVE-2020-10123The currency dispenser of NCR SelfSev ATMs running APTRA XFS…5.3
• CVE-2020-10124NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt,…7.1
• CVE-2020-10126NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly…7.6
• CVE-2020-10128SearchBlox product with version before 9.2.1 is vulnerable t…5.4
• CVE-2020-10129SearchBlox before Version 9.2.1 is vulnerable to Privileged …8.8
• CVE-2020-1013<p>An elevation of privilege vulnerability exists when Micro…7.5
• CVE-2020-10130SearchBlox before Version 9.1 is vulnerable to business logi…8.8
• CVE-2020-10131SearchBlox before Version 9.2.1 is vulnerable to CSV macro i…9.8