{"cve":"CVE-2020-10125","nvd":{"published":"2020-08-21T21:15:11.497","modified":"2026-06-17T02:47:24.417","status":"Modified","description":"NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software updates, which can be broken by an attacker with physical access in a sufficiently short period of time, thereby enabling the attacker to sign arbitrary files and CAB archives used to update BNA software, as well as bypass application whitelisting, resulting in the ability to execute arbitrary code.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":7.6},"cwes":["CWE-326"],"references":["https://kb.cert.org/vuls/id/815655","https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_","https://kb.cert.org/vuls/id/815655","https://www.kb.cert.org/vuls/id/815655","https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_"],"products":["ncr:aptra_xfs"],"source":"nvd","synced_at":"2026-10-19T21:09:20.498348299+00:00"},"epss":{"cve":"CVE-2020-10125","score":0.0019,"percentile":0.08708,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}