CVE-2021-3122

CRITICALNuclei

ncr command_center_agent Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-3122 has a selected CVSS score of 9.8 (critical); EIP currently links 1 catalogued exploit, 1 repository PoC, and 1 Nuclei template.

Description

CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089) that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: the vendor's position is that exploitation occurs only on devices with a certain "misconfiguration."

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Feb 7, 2021 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1
Repository PoCs
1
Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

command_center_agent

Browse ncr / command_center_agent
VulnCheckVersion data not supplied

Proofs of concept

2

Catalogued exploits

MetasploitNCR Command Center Agent Remote Code ExecutionMetasploit exploitby daffainfo (Muhammad Daffa) +1 moreExploit1 file

Ruby

Metasploit
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2021-3122 by sending a crafted XML document containing a runCommand parameter to port 8089, enabling remote unauthenticated command execution as SYSTEM on NCR Command Center Agent 16.3.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit exploit for CVE-2021-3122. It sends a crafted XML payload containing a PowerShell command to a target service on port 8089 to achieve remote code execution. No backdoor, deceptive payload, or concealed operator-directed harm is present. The code performs only the documented exploit behavior.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareNCR Command Center Agent
Attack typesremote_code_execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module's exploit method sends a crafted XML payload containing an attacker-supplied command to a vulnerable service, which is the core behavior of an exploit. The module is classified as 'exploit' in its metadata and includes code to deliver and execute a payload.

modules/exploits/windows/misc/ncr_cmcagent_rce.rb:113-129modules/exploits/windows/misc/ncr_cmcagent_rce.rb:6

Requirements

  • Target must be running NCR Command Center Agent 16.3 on port 8089.modules/exploits/windows/misc/ncr_cmcagent_rce.rb:19-20

Observed behavior

  • Connects to the target on the configured RPORT (default 8089).modules/exploits/windows/misc/ncr_cmcagent_rce.rb:114
  • Generates a PowerShell command payload using cmd_psh_payload.modules/exploits/windows/misc/ncr_cmcagent_rce.rb:117
  • Constructs an XML document containing the payload inside an <Arguments> element under a runCommand workitem.modules/exploits/windows/misc/ncr_cmcagent_rce.rb:81-108
  • Sends the XML payload to the target over the TCP connection.modules/exploits/windows/misc/ncr_cmcagent_rce.rb:122
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Payload withheldThe module constructs an XML document containing a user-supplied payload command and sends it to the target service, consistent with the described vulnerability.modules/exploits/windows/misc/ncr_cmcagent_rce.rb:81-108modules/exploits/windows/misc/ncr_cmcagent_rce.rb:113-122
Payload Generation
Payload withheldThe exploit uses the standard Metasploit PowerShell payload generation mixin to create the command executed on the target. The payload is controlled by the operator, not hardcoded.modules/exploits/windows/misc/ncr_cmcagent_rce.rb:117
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The artifact was not executed, and its behavior is inferred from static analysis of the Ruby source.
  • Analysis is limited to the module source code. Framework mixins (e.g., Msf::Exploit::Powershell, Msf::Exploit::Remote::Tcp) and the final payload are not expanded or reviewed. The module's behavior depends on those components, but the module itself shows no backdoor.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Repository PoCs

GitHubacquiredsecurity/CVE-2021-3122-DetailsRepository PoCby acquiredsecurity3Not analyzed2 files

3.6 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryCRITICALNCR Command Center Agent 16.3 - Remote Command ExecutionCVSS 9.8

CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089) that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: the vendor's position is that exploitation occurs only on devices with a certain "misconfiguration."

Impact

Unauthenticated attackers can execute arbitrary system commands as SYSTEM on NCR Aloha POS/BOH servers by submitting malicious XML documents to port 8089, potentially compromising point-of-sale systems and accessing sensitive payment data.

Remediation

Apply the latest security updates from NCR to disable the vulnerable runCommand functionality or implement proper authentication and input validation on the CMCAgent service.

WeaknessesCWE-78
Authorsdaffainfo, jjcho
Template tagscvecve2021ncrrcevkevintrusivevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:ncr:command_center_agent:16.3:*:*:*:*:*:*:*
Shodan: mynodename
FOFA: mynodename
https://hcs-team.com/blog/cve-2021-3122/ https://github.com/acquiredsecurity/CVE-2021-3122-Details/blob/main/CVE-2021-3122 https://www.tetradefense.com/incident-response-services/active-exploit-a-remote-code-execution-rce-vulnerability-for-ncr-aloha-point-of-sale/ https://nvd.nist.gov/vuln/detail/CVE-2021-3122

Source: ProjectDiscovery

References

4