CVE-2018-20052

An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. The user running the main CCE firmware has NOPASSWD sudo privileges to several utilities that could be used to escalate privileges to root. One example is the "sudo ln -s /tmp/script /etc/cron.hourly/script" command.

Score

CVSS 3.0 7.8 High

Status

Modified - cve@mitre.org

Published

2019-04-25

Last modified

2024-08-05

Weaknesses

CWE-1188

Affected products

• Connectivity Engine 4 Firmware (Cerner)

References

• https://www.securifera.com/advisories/cve-2018-20052-20053/