CVE-2013-2571

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 16.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-01-28 · updated 2026-06-16
Weakness: CWE-20

Description

Iris 3.8 before build 1548, as used in Xpient point of sale (POS) systems, allows remote attackers to execute arbitrary commands via a crafted request to TCP port 7510, as demonstrated by opening the cash drawer.

Affected products

Hcomm Xpient Iris: through 3.8

References

http://www.exploit-db.com/exploits/25987
http://www.securityfocus.com/bid/60359
https://exchange.xforce.ibmcloud.com/vulnerabilities/84761
https://packetstormsecurity.com/files/121917/Xpient-POS-Iris-3.8-Cash-Drawer-Operation-Remote-Trigger.html
http://www.exploit-db.com/exploits/25987
http://www.securityfocus.com/bid/60359
https://exchange.xforce.ibmcloud.com/vulnerabilities/84761
https://packetstormsecurity.com/files/121917/Xpient-POS-Iris-3.8-Cash-Drawer-Operation-Remote-Trigger.html

Get alerted when CVE-2013-2571 or the next vulnerability affects your stack