Critical · published June 23, 2025
🚨 A crafty script to an IP camera URL is the ticket for an attacker to run arbitrary code on NCR ITM Web terminal v4.4.0 and v4.4.4! 🔥 This vulnerability is like a delivery person who doesn't check the package contents before handing it over — they could deliver anything, even a ticking time bomb! An attacker could gain full control over the terminal, allowing them to carry out malicious activities such as accessing sensitive data, modifying settings, or even launching further attacks on the network. This is absolutely devastating for any organization relying on these terminals!
This vulnerability is like a delivery person who doesn't check the package contents before handing it over — they could deliver anything, even a ticking time bomb! This vulnerability allows remote attackers to send crafted scripts to the IP camera URL component of NCR ITM Web terminal, leading to arbitrary code execution without proper validation.
An attacker could gain full control over the terminal, allowing them to carry out malicious activities such as accessing sensitive data, modifying settings, or even launching further attacks on the network. This is absolutely devastating for any organization relying on these terminals! Immediately patch to version 4.4.5 or later to eliminate this vulnerability. Ensure that all exposure points to the IP camera URL are properly secured and configured to reject unauthorized scripts. Regularly audit your systems for any potential vulnerabilities. You've got this! Follow these steps and bolster your defenses like a pro! 🛡️