CVE-2021-3122

https://notcve.org/view.php?id=CVE-2021-3122

CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089) that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: the vendor's position is that exploitation occurs only on devices with a certain "misconfiguration." CMCAgent en el NCR Command Center Agent versión 16.3, en los servidores Aloha POS/BOH permite el envío de un parámetro runCommand (dentro de un documento XML enviado al puerto 8089) que permite una ejecución no autenticada remota de un comando arbitrario como SYSTEM, como se explotó "in the wild" en 2020 y/o 2021. NOTA: la posición del proveedor es que la explotación se produce solo en dispositivos con un determinada "misconfiguration" • https://github.com/acquiredsecurity/CVE-2021-3122-Details https://github.com/roughb8722/CVE-2021-3122-Details/blob/main/CVE-2021-3122 https://rdf2.alohaenterprise.com/client/CMCInst.zip https://www.tetradefense.com/incident-response-services/active-exploit-a-remote-code-execution-rce-vulnerability-for-ncr-aloha-point-of-sale • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •