Back to KEVs

CVE-2021-3122

CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to...

Basic Information

CVE State
PUBLISHED
Reserved Date
January 11, 2021
Published Date
February 07, 2021
Last Updated
August 03, 2024
Vendor
n/a
Product
n/a
Description
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089) that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: the vendor's position is that exploitation occurs only on devices with a certain "misconfiguration."

CVSS Scores

CVSS v3.1

9.8 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

10.0

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploit Status

Exploited in the Wild
Yes (2021-02-07 19:45:03 UTC) Source

References

https://rdf2.alohaenterprise.com/client/CMCInst.zip https://www.tetradefense.com/incident-response-services/active-exploit-a-remote-code-execution-rce-vulnerability-for-ncr-aloha-point-of-sale/ https://github.com/roughb8722/CVE-2021-3122-Details/blob/main/CVE-2021-3122

Known Exploited Vulnerability Information

Source Added Date
CVE 2021-02-07 19:45:03 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

acquiredsecurity/CVE-2021-3122-Details

Type: github • Created: 2021-02-07 16:05:49 UTC • Stars: 3

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel