CVE-2021-3122

What it actually does

The flaw is an unauthenticated command injection / remote code execution issue in the NCR Command Center Agent CMCAgent service on Aloha POS/back-office servers. A network-accessible service listening on TCP port 8089 accepts XML input containing a runCommand parameter and executes attacker-supplied operating system commands. Because the service can run commands as NT AUTHORITY\SYSTEM, successful exploitation provides full host-level control, including the ability to read or modify files, install services, dump credentials, disable security tools, pivot to adjacent systems, and disrupt POS/back-office operations. The CVSS 9.8 score, weaponized exploit maturity, and high EPSS probability indicate this should be treated as actively exploitable even though it is not currently listed in CISA KEV. The provided affected-product metadata references nuxt/nuxt with a fixed Git commit, which conflicts with the NCR Command Center Agent description; organizations should validate applicability against both vendor advisories and asset inventory before relying on package metadata alone.

Why it matters to the business

A vulnerable, network-reachable POS/back-office management agent can allow an outside attacker or intruder on the local network to take complete control of systems that support store operations. Consequences can include POS outage, payment-processing disruption, theft of sensitive operational or payment-adjacent data, malware deployment, credential compromise, and lateral movement into broader corporate systems. Because exploitation has been reported in the wild and the EPSS score is high, exposed systems should be prioritized as urgent even though the issue is older and not currently in CISA KEV.

How an attack unfolds

An attacker first identifies systems exposing the NCR Command Center Agent management service, commonly by scanning for TCP port 8089 or by discovering Aloha POS/back-office servers during internal reconnaissance. If the service is reachable and improperly exposed or configured, the attacker sends a crafted XML request containing a runCommand parameter. The vulnerable agent processes the request without requiring authentication and passes attacker-controlled content to the operating system. The command executes with SYSTEM privileges, giving the attacker immediate high-integrity execution on the host. From there, the attacker commonly establishes persistence, stages tooling, enumerates local credentials and network shares, disables or evades security controls, and pivots toward other store, payment, or corporate systems. Known exploitation in 2020/2021 means responders should assume public tradecraft exists and review historical logs where retention permits.

How to fix it

Upgrade or patch the affected management agent according to NCR/vendor guidance and verify that unauthenticated command execution is no longer possible. If the supplied package metadata is relevant to a local software dependency, update nuxt/nuxt to a revision that includes commit 0d5dfe71917191c5b07f373896311f2d8f6b75be; however, this metadata conflicts with the NCR Command Center Agent description, so remediation ownership should be confirmed against authoritative vendor advisories and installed software evidence. Restrict TCP port 8089 to only required management networks and hosts, and block all internet exposure. Enforce host firewall rules, network segmentation for POS/back-office systems, least-privilege service configuration where supported, and strong monitoring around management services. If immediate patching is not possible, disable the CMCAgent service where operationally feasible, isolate affected systems, and apply compensating controls that prevent untrusted access to the service.

How to confirm the fix worked

Confirm asset exposure by identifying hosts running NCR Command Center Agent / CMCAgent and checking whether TCP port 8089 is listening and reachable from untrusted networks. Validate the installed vendor version or build against the vendor-fixed release, and separately verify whether any nuxt/nuxt dependency in scope contains commit 0d5dfe71917191c5b07f373896311f2d8f6b75be if that metadata applies. After remediation, ensure unauthenticated requests containing runCommand are rejected, ignored, or logged without command execution. Review firewall and network ACLs to confirm port 8089 is limited to approved management sources only. Validate with authenticated configuration review and controlled security testing rather than production-impacting exploit attempts.

Typical attack path

1. Scan external or internal networks for systems exposing TCP port 8089 associated with the Command Center Agent service.
2. Confirm the service accepts XML requests to the management endpoint.
3. Submit a crafted XML document containing a runCommand parameter with an operating system command.
4. Achieve unauthenticated command execution as SYSTEM on the vulnerable server.
5. Run reconnaissance commands to identify users, network configuration, installed security tools, and accessible shares.
6. Deploy follow-on payloads, persistence mechanisms, remote access tools, or scripts.
7. Use harvested credentials or trusted POS/back-office connectivity to move laterally or disrupt operations.

How to detect it

Investigate network, endpoint, and application telemetry for evidence of unauthenticated requests to TCP port 8089 containing XML fields named runCommand. Review web/service logs, CMCAgent logs if available, Windows Event Logs, EDR process trees, firewall logs, proxy logs, and network IDS/packet metadata. On Windows hosts, focus on process-creation events where CMCAgent.exe or the Command Center Agent service spawns cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, curl.exe, wget.exe, net.exe, nltest.exe, whoami.exe, ipconfig.exe, or other administrative utilities. Look for SYSTEM-owned processes executing shortly after inbound connections to port 8089, especially from unusual source IPs or non-management networks. Review Windows Security Event ID 4688, Sysmon Event ID 1 process creation, Sysmon Event ID 3 network connections, service creation events such as 7045, scheduled task events, PowerShell logs, and antivirus/EDR tamper alerts. If exploitation is suspected, collect memory/process listings, recent file writes, persistence locations, service definitions, scheduled tasks, local administrator group changes, and outbound connections for follow-on command-and-control or data staging.

• TCP/8089
• runCommand
• <runCommand>
• CMCAgent
• CMCAgent.exe
• Command Center Agent
• NT AUTHORITY\\SYSTEM
• ParentImage=*CMCAgent.exe* Image=*cmd.exe*
• ParentImage=*CMCAgent.exe* Image=*powershell.exe*
• ParentImage=*CMCAgent.exe* Image=*wscript.exe*
• ParentImage=*CMCAgent.exe* Image=*cscript.exe*
• ParentImage=*CMCAgent.exe* Image=*mshta.exe*
• ParentImage=*CMCAgent.exe* Image=*rundll32.exe*
• ParentImage=*CMCAgent.exe* Image=*regsvr32.exe*
• ParentImage=*CMCAgent.exe* Image=*certutil.exe*
• ParentImage=*CMCAgent.exe* Image=*bitsadmin.exe*
• ParentImage=*CMCAgent.exe* Image=*net.exe*
• ParentImage=*CMCAgent.exe* Image=*whoami.exe*
• ParentImage=*CMCAgent.exe* Image=*ipconfig.exe*
• EventCode=4688 ParentProcessName=*CMCAgent.exe*
• EventID=1 ParentImage=*CMCAgent.exe*
• EventID=3 DestinationPort=8089
• EventID=7045

What your security team should do

• Immediately inventory POS/back-office servers and identify any NCR Command Center Agent / CMCAgent instances listening on TCP port 8089.
• Prioritize remediation or isolation of any instance reachable from the internet, corporate user networks, guest networks, or other untrusted segments.
• Apply the vendor fix or upgrade path; if the provided nuxt/nuxt metadata is relevant, ensure the codebase includes commit 0d5dfe71917191c5b07f373896311f2d8f6b75be.
• Block or tightly restrict TCP port 8089 at perimeter, site-to-site, and host firewall layers.
• Hunt historical logs for XML requests containing runCommand, unexpected child processes spawned by CMCAgent, and SYSTEM-level execution of scripting or shell utilities.
• Treat confirmed exploitation as full host compromise: preserve evidence, isolate the host, rotate credentials exposed to the system, and investigate lateral movement.
• Add SIEM detections for CMCAgent spawning command shells, PowerShell, scripting engines, file-transfer utilities, or remote administration tools.
• Review POS/back-office segmentation and ensure management services are not accessible from broad corporate or internet-facing networks.