CVE-2020-10126

NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate softare updates for the bunch note acceptor (BNA), enabling an attacker with physical access to internal ATM components to restart the host computer and execute arbitrary code with SYSTEM privileges because while booting, the update process looks for CAB archives on removable media and executes a specific file without first validating the signature of the CAB archive.

• CWE-305
• CWE-347

• https://kb.cert.org/vuls/id/815655Third Party Advisory, US Government Resource
• https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_Broken Link
• https://kb.cert.org/vuls/id/815655Third Party Advisory, US Government Resource
• https://www.kb.cert.org/vuls/id/815655
• https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_Broken Link

Published

Aug 21, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10120cPanel before 84.0.20 allows resellers to achieve remote cod…7.2
• CVE-2020-10121cPanel before 84.0.20 allows a demo account to achieve code …9.8
• CVE-2020-10122cPanel before 84.0.20 allows a webmail or demo account to de…6.5
• CVE-2020-10123The currency dispenser of NCR SelfSev ATMs running APTRA XFS…5.3
• CVE-2020-10124NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt,…7.1
• CVE-2020-10125NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 im…7.6
• CVE-2020-10128SearchBlox product with version before 9.2.1 is vulnerable t…5.4
• CVE-2020-10129SearchBlox before Version 9.2.1 is vulnerable to Privileged …8.8
• CVE-2020-1013<p>An elevation of privilege vulnerability exists when Micro…7.5
• CVE-2020-10130SearchBlox before Version 9.1 is vulnerable to business logi…8.8
• CVE-2020-10131SearchBlox before Version 9.2.1 is vulnerable to CSV macro i…9.8
• CVE-2020-10132SearchBlox before Version 9.1 is vulnerable to cross-origin …6.1