CVE-2020-10126: ncr aptra_xfs
Vulnerability summary
CVE-2020-10126 is a high (CVSS 7.6) vulnerability in ncr aptra_xfs. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.1% of scored vulnerabilities.
Timeline
- 21-08-2020PublishedVulnerability first disclosed.
- 04-11-2025Last modifiedVulnerability information updated.
Description
NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate softare updates for the bunch note acceptor (BNA), enabling an attacker with physical access to internal ATM components to restart the host computer and execute arbitrary code with SYSTEM privileges because while booting, the update process looks for CAB archives on removable media and executes a specific file without first validating the signature of the CAB archive.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
19%
Versus all other CVEs
30-day change
0.00 pp
From 0.28% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-305Authentication Bypass by Primary WeaknessThe authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
- CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.
Affected systems
Ncr2 products
- aptra_xfs05.01.00
- selfserv atmAPTRA XFS 05.01.00
1 vendor · 2 products
References
3 links- www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_X Refsource MISCBroken Link