published February 7, 2021
NVD has not assigned a CVSS score to this record. It sits in the 99.8th percentile for exploit probability.
⚠️ A simple XML command could let anyone run commands as SYSTEM on vulnerable NCR Command Center Agent servers! Think of it like a delivery person handing over the building's master key without checking ID. If your Aloha POS/BOH servers are misconfigured, they might just unlock the door for anyone! An attacker could exploit this vulnerability to execute arbitrary commands, potentially gaining complete control over the affected system. This could lead to unauthorized access to sensitive data, system manipulation, and even disruptions in your POS operations. The consequences could be financially devastating!
Think of it like a delivery person handing over the building's master key without checking ID. If your Aloha POS/BOH servers are misconfigured, they might just unlock the door for anyone! The CMCAgent in NCR Command Center Agent 16.3 allows unauthenticated remote code execution through a 'runCommand' parameter in an XML document sent to port 8089, but only if specific misconfigurations are present on the devices.
An attacker could exploit this vulnerability to execute arbitrary commands, potentially gaining complete control over the affected system. This could lead to unauthorized access to sensitive data, system manipulation, and even disruptions in your POS operations. The consequences could be financially devastating! To protect against this vulnerability, ensure that your systems are properly configured and not exposing the vulnerable parameters. Regularly audit your configurations and apply any security updates provided by NCR. It's best to monitor your systems for any unusual activity as an added precaution. You've got this! By being proactive, you can keep your systems secure and operational! 🛡️