CVE-2023-29060
Vulnerability from cvelistv5
Published
2023-11-28 20:07
Modified
2024-08-02 14:00
Severity ?
5.4 (Medium) - CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Summary
Lack of USB Whitelisting
References
cybersecurity@bd.comhttps://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-softwareMitigation, Vendor Advisory
Impacted products
Becton, Dickinson and Company (BD)FACSChorus
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T14:00:14.601Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "64 bit"
          ],
          "product": "FACSChorus",
          "vendor": "Becton, Dickinson and Company (BD)",
          "versions": [
            {
              "lessThanOrEqual": "5.1",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.1",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-11-28T14:24:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor with physical access to the workstation could gain access to system information and potentially exfiltrate data."
            }
          ],
          "value": "The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor with physical access to the workstation could gain access to system information and potentially exfiltrate data."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-457",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-457 USB Memory Attacks"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1299",
              "description": "CWE-1299 Missing Protection Mechanism for Alternate Hardware Interface",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-28T20:31:55.731Z",
        "orgId": "2325d071-eabf-4b7b-a4ea-0819b6629a18",
        "shortName": "BD"
      },
      "references": [
        {
          "url": "https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Lack of USB Whitelisting",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Vulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Please check periodically for updates. Additionally, BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:\u003cbr\u003e\u003cul\u003e\u003cli\u003eEnsure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.\u003c/li\u003e\u003cli\u003eIf the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.\u003c/li\u003e\u003cli\u003eAdministrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "Vulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Please check periodically for updates. Additionally, BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:\n  *  Ensure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.\n  *  If the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.\n  *  Administrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.\n\n\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2325d071-eabf-4b7b-a4ea-0819b6629a18",
    "assignerShortName": "BD",
    "cveId": "CVE-2023-29060",
    "datePublished": "2023-11-28T20:07:00.245Z",
    "dateReserved": "2023-03-30T21:10:17.526Z",
    "dateUpdated": "2024-08-02T14:00:14.601Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-29060\",\"sourceIdentifier\":\"cybersecurity@bd.com\",\"published\":\"2023-11-28T20:15:07.230\",\"lastModified\":\"2023-12-05T14:44:26.333\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor with physical access to the workstation could gain access to system information and potentially exfiltrate data.\"},{\"lang\":\"es\",\"value\":\"El sistema operativo de la estaci\u00f3n de trabajo FACSChorus no restringe qu\u00e9 dispositivos pueden interactuar con sus puertos USB. Si se explota, un actor de amenazas con acceso f\u00edsico a la estaci\u00f3n de trabajo podr\u00eda obtener acceso a la informaci\u00f3n del sistema y potencialmente filtrar datos.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"baseScore\":5.7,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":0.9,\"impactScore\":4.7},{\"source\":\"cybersecurity@bd.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":0.7,\"impactScore\":4.7}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-306\"}]},{\"source\":\"cybersecurity@bd.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1299\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:hp:hp_z2_tower_g9:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"54279DE4-A2A4-4AA6-A05F-931094446F16\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:bd:facschorus:5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D5E0D4F-559B-414E-A627-0BA0937BD7F1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:bd:facschorus:5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"57F63FB2-2AE2-4B5F-8B49-4A0A4549CF3E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:hp:hp_z2_tower_g5:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7E9BA28D-9C14-435A-9786-222BE58A9258\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:bd:facschorus:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2785D17E-800C-4772-A131-5737E9446C01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:bd:facschorus:3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"30FD1DE4-982F-4D14-BB8A-478F8430BC63\"}]}]}],\"references\":[{\"url\":\"https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software\",\"source\":\"cybersecurity@bd.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.