Black Friday60% off BLACKFRIDAY2026
Platform
PlansPartners
Resources
ToolsBlogDocs
Sign Up →
critical·Network Vulnerabilities·Updated Oct 2, 2025

NCR Command Center Agent 16.3 - Remote Command Execution

Est. Time~10 seconds
Scan TypeSingle Scan
Targetsdomain, subdomain, ipv4
CostFree
0
Times Used
continuous scan runs
9
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
9.8
CVSS
Description

CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089) that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: the vendor's position is that exploitation occurs only on devices with a certain "misconfiguration."

Attack Vector
-
Privileges Req.
-
User Interaction
-
Affected
n/aby n/a
n/a
Updated Nov 10, 2026View on NVD →

Check your infrastructure.
Right now.

12,000+ scanners. Free to start. No credit card required.

Browse All Tools