Robert Roberson

An issue was discovered where the user running the main CCE firmware has NOPASSWD sudo privileges to several utilities, which could be used to escalate privileges to root. For example, the command "sudo ln -s /tmp/script /etc/cron.hourly/script" could be utilized.

An issue was discovered where the hostname, timezone, and NTP server configurations are vulnerable to command injection by sending a crafted configuration file over the network.