Robert Roberson

**Name of the Vulnerable Software and Affected Versions** Cerner Connectivity Engine (CCE) version 4 **Description** An issue was discovered where the user running the main CCE firmware has NOPASSWD sudo privileges to several utilities, which could be used to escalate privileges to root. For example, the command "sudo ln -s /tmp/script /etc/cron.hourly/script" could be utilized. **Recommendations** For Cerner Connectivity Engine (CCE) version 4, restrict the sudo privileges of the user running the main CCE firmware to prevent escalation to root. As a temporary workaround, consider disabling the use of sudo for the affected utilities until a more permanent solution is implemented.

**Name of the Vulnerable Software and Affected Versions** Cerner Connectivity Engine (CCE) version 4 **Description** An issue was discovered where the hostname, timezone, and NTP server configurations are vulnerable to command injection by sending a crafted configuration file over the network. **Recommendations** For Cerner Connectivity Engine (CCE) version 4, consider restricting access to configuration files to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using network-sent configuration files that could potentially be crafted to inject commands.