Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2020-10125

NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software updates, which can be broken by an attac

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
certcc

Description

NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software updates, which can be broken by an attacker with physical access in a sufficiently short period of time, thereby enabling the attacker to sign arbitrary files and CAB archives used to update BNA software, as well as bypass application whitelisting, resulting in the ability to execute arbitrary code.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

NCR SelfServ ATM

  • APTRA XFS 04.02.01affected
  • APTRA XFS 05.01.00affected

References