CVE-2018-20053

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-25 · updated 2026-06-17

Description

An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. The hostname, timezone, and NTP server configurations on the CCE device are vulnerable to command injection by sending a crafted configuration file over the network.

Affected products

Cerner Connectivity Engine 4 Firmware: before 201812 — fixed in 201812

How to fix

Upgrade to a fixed version: Cerner Connectivity Engine 4 Firmware 201812. Check the vendor advisory for mitigations.

References

https://www.securifera.com/advisories/cve-2018-20052-20053/
https://www.securifera.com/advisories/cve-2018-20052-20053/

Get alerted when CVE-2018-20053 or the next vulnerability affects your stack