CVE-2020-10124: ncr aptra_xfs

Vulnerability summary

CVE-2020-10124 is a high (CVSS 7.1) vulnerability in ncr aptra_xfs. EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 53.4% of scored vulnerabilities.

Timeline

1. 21-08-2020
   PublishedVulnerability first disclosed.
2. 04-11-2025
   Last modifiedVulnerability information updated.

Description

NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer, which could allow an attacker with physical access to the internal components of the ATM to execute arbitrary code, including code that enables the attacker to commit deposit forgery.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
• CWE-311Missing Encryption of Sensitive DataThe product does not encrypt sensitive or critical information before storage or transmission.
• CWE-353Missing Support for Integrity CheckThe product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
• CWE-319Cleartext Transmission of Sensitive InformationThe product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.