CVE-2021-3122

CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089) that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: the vendor's position is that exploitation occurs only on devices with a certain "misconfiguration."

CVSS v3 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://github.com/roughb8722/CVE-2021-3122-Details/blob/main/CVE-2021-3122	Third Party Advisory
https://rdf2.alohaenterprise.com/client/CMCInst.zip	Third Party Advisory
https://www.tetradefense.com/incident-response-services/active-exploit-a-remote-code-execution-rce-vulnerability-for-ncr-aloha-point-of-sale/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ncr:command_center_agent:16.3:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-02-07 20:15

Updated : 2024-02-28 18:08

NVD link : CVE-2021-3122

Mitre link : CVE-2021-3122

CVE.ORG link : CVE-2021-3122

JSON object : View

Products Affected

ncr

command_center_agent

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2021-3122", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-02-07T20:15:12.543", "references": [{"url": "https://github.com/roughb8722/CVE-2021-3122-Details/blob/main/CVE-2021-3122", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://rdf2.alohaenterprise.com/client/CMCInst.zip", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.tetradefense.com/incident-response-services/active-exploit-a-remote-code-execution-rce-vulnerability-for-ncr-aloha-point-of-sale/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089) that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: the vendor's position is that exploitation occurs only on devices with a certain \"misconfiguration.\""}, {"lang": "es", "value": "CMCAgent en el NCR Command Center Agent versi\u00f3n 16.3, en los servidores Aloha POS/BOH permite el env\u00edo de un par\u00e1metro runCommand (dentro de un documento XML enviado al puerto 8089) que permite una ejecuci\u00f3n no autenticada remota de un comando arbitrario como SYSTEM, como se explot\u00f3 \"in the wild\" en 2020 y/o 2021. NOTA: la posici\u00f3n del proveedor es que la explotaci\u00f3n se produce solo en dispositivos con un determinada \"misconfiguration\""}], "lastModified": "2021-02-09T18:15:44.933", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ncr:command_center_agent:16.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F18EA2ED-B893-4365-99C4-E177D650BFF5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}