Ncr vulnerabilitiesNone on the known-exploited list.
Ncr has 12 published vulnerabilities across 14 products in our catalogue. None of them is on the list of flaws known to be exploited today. The most affected product is Aptra Xfs, with 5. If you run Ncr software, patch the exploited flaws first.
We keep watching the known-exploited list.
Which Ncr products have the most vulnerabilities?
Aptra Xfs leads with 5 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Ncr vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Ncr's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Ncr flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 87%CVE-2021-3122Critical
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089) that enables the remote, unauthenticated execution of an...
- 1.7%CVE-1999-0019Medium
Delete or create a file via rpc.statd, due to invalid information.
- 1.2%CVE-2018-5717High
Memory write mechanism in NCR S2 Dispenser controller before firmware version 0x0108 allows an unauthenticated user to upgrade or downgrade the firmware of the device, including to older versions with known...
- 1.1%CVE-2017-17668High
Memory write mechanism in NCR S1 Dispenser controller before firmware version 0x0156 allows an unauthenticated user to upgrade or downgrade the firmware of the device, including to older versions with known...
- 0.9%
pcnfsd (aka rpc.pcnfsd) allows local users to change file permissions, or execute arbitrary commands through arguments in the RPC call.
- 0.7%CVE-2020-10124High
NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer, which could allow an attacker with physical access to the internal...
- 0.7%CVE-2020-9063High
NCR SelfServ ATMs running APTRA XFS 05.01.00 or earlier do not authenticate or protect the integrity of USB HID communications between the currency dispenser and the host computer, permitting an attacker with...
- 0.6%CVE-1999-0033High
Command execution in Sun systems via buffer overflow in the at program.
- 0.4%CVE-2020-10123Medium
The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation requests from the host computer, allowing an attacker with physical access to...
- 0.3%CVE-2023-47022Medium
Insecure Direct Object Reference in NCR Terminal Handler v.1.5.1 allows an unprivileged user to edit the audit logs for any user and can lead to CSV injection.
All Ncr products we track.
11 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Aptra Xfsaptra_xfs5 vulnerabilities2 versions
- Mp-Rasmp-ras3 vulnerabilities3 versions
- Command Center Agentcommand_center_agent1 vulnerability1 version
- S1 Dispenser Controller Firmwares1_dispenser_controller_firmware1 vulnerability1 version
- S2 Dispenser Controller Firmwares2_dispenser_controller_firmware1 vulnerability1 version
- Terminal Handlerterminal_handler1 vulnerability1 version
- Bootdiskmonbootdiskmon0 vulnerabilities2 versions
- Ncr Sm3g Cmic Legacyncr_sm3g_cmic_legacy0 vulnerabilities1 version
- Pci Configuratorpci_configurator0 vulnerabilities1 version
- Tastas0 vulnerabilities1 version
- Wintools for Windowswintools_for_windows0 vulnerabilities1 version
This directory lists the 11 Ncr products with at least one tracked version, of 14 in our catalogue.
Running Ncr? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089) that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: the vendor's position is that exploitation occurs only on devices with a certain "misconfiguration."
- Matched to
- Command Center Agent on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 12 published vulnerabilities across 14 products and 15 versions from Ncr.
None of Ncr's vulnerabilities is on the list of flaws known to be exploited today.
Aptra Xfs, with 5 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Ncr products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.