CVE-2020-10125
N/A
N/A
Summary
NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software updates, which can be broken by an attacker with physical access in a sufficiently short period of time, thereby enabling the attacker to sign arbitrary files and CAB archives used to update BNA software, as well as bypass application whitelisting, resulting in the ability to execute arbitrary code.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| NCR | SelfServ ATM | APTRA XFS 04.02.01 | affected |
| NCR | SelfServ ATM | APTRA XFS 05.01.00 | affected |
Weaknesses
- CWE-326: CWE-326 Inadequate Encryption Strength
ADP Enrichment
CVE Program Container
Additional References
- https://kb.cert.org/vuls/id/815655
- https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_
- https://www.kb.cert.org/vuls/id/815655
References
- https://kb.cert.org/vuls/id/815655
- https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.