Loading vulnerability…
CVE-2021-3122 affects the CMCAgent component of NCR Command Center Agent 16.3 on Aloha point-of-sale and back-of-house servers. The RUNCommand function accepts a runCommand parameter in a specially crafted XML request delivered over TCP port 8089, allowing remote, unauthenticated execution of arbitrary commands with SYSTEM privileges. The vulnerability was exploited in the wild in 2020 and/or 2021. NCR maintains that exploitation requires an unsupported configuration exposing the agent's listening port.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a single Metasploit module (Ruby file) that exploits a remote code execution (RCE) vulnerability (CVE-2021-3122) in NCR Command Center Agent (CMCAgent) version 16.3, typically deployed on Aloha POS/BOH servers. The exploit targets the service listening on TCP port 8089 and abuses the 'runCommand' parameter in an XML document to execute arbitrary commands as SYSTEM, without authentication, due to a misconfiguration. The module is fully integrated with Metasploit, allowing the use of customizable payloads (defaulting to a Meterpreter reverse shell via PowerShell). The code includes a check method to detect the presence of the vulnerable service and an exploit method that crafts and sends the malicious XML payload. The repository is weaponized, operational, and intended for use within the Metasploit framework.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated remote command execution vulnerability in CMCAgent, part of NCR Command Center Agent 16.3 on Aloha POS/BOH servers. An attacker can submit an XML document containing a runCommand parameter to port 8089 and execute arbitrary commands with SYSTEM privileges. Exploitation occurred in the wild in 2020 and/or 2021. The vendor states that exploitation requires a certain device misconfiguration, which the record does not specify.
A remote code execution vulnerability in NCR Aloha POS's Command Center Agent (cmcAgent.exe). An attacker can send a specially crafted XML request to an exposed agent on TCP port 8089 and execute commands with SYSTEM privileges. The report describes active exploitation in a credit-card theft incident and assigns a severity score of 9.8. NCR characterizes the exposure as an unsupported client configuration and updated its documentation to prohibit internet-facing deployment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.