VULNERABILITY INTELLIGENCE

CVE-2020-10124

CVSS score7.1 HIGH
EPSS probability0.73%
CISA KEVNot currently listed
Published2020-08-21
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer, which could allow an attacker with physical access to the internal components of the ATM to execute arbitrary code, including code that enables the attacker to commit deposit forgery.

Weakness classification

  • CWE-306: Missing Authentication for Critical Function
  • CWE-311: Missing Encryption of Sensitive Data
  • CWE-319: Cleartext Transmission of Sensitive Information
  • CWE-353: Missing Support for Integrity Check

Primary references