csaf_cisa - icsma-23-331-01

icsma-23-331-01

Vulnerability from csaf_cisa

Published

2023-11-28 07:00

Modified

2023-11-28 07:00

Summary

BD FACSChorus

Notes

Legal Notice

All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.

Risk evaluation

Successful exploitation of these vulnerabilities could allow an attacker with physical access to the device to modify system configurations, obtain access to sensitive information, or access components of the system.

Critical infrastructure sectors

Healthcare and Public Health

Countries/areas deployed

Worldwide

Company headquarters location

United States

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this these vulnerabilities, such as:

Recommended Practices

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Recommended Practices

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

Recommended Practices

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

Recommended Practices

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

Recommended Practices

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Recommended Practices

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Recommended Practices

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Recommended Practices

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Recommended Practices

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Milind Sunilbhai Purswani"
        ],
        "summary": "reporting these vulnerabilities to CISA"
      },
      {
        "organization": "BD",
        "summary": "reporting these vulnerabilities to CISA"
      },
      {
        "names": [
          "Michael Aguilar (v3ga)"
        ],
        "organization": "Secureworks",
        "summary": "reporting these vulnerabilities to CISA"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities could allow an attacker with physical access to the device to modify system configurations, obtain access to sensitive information, or access components of the system.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Healthcare and Public Health",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of this these vulnerabilities, such as:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolating them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSMA-23-331-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsma-23-331-01.json"
      },
      {
        "category": "self",
        "summary": "ICSA Advisory ICSMA-23-331-01 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-331-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "BD FACSChorus",
    "tracking": {
      "current_release_date": "2023-11-28T07:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSMA-23-331-01",
      "initial_release_date": "2023-11-28T07:00:00.000000Z",
      "revision_history": [
        {
          "date": "2023-11-28T07:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "Initial Publication"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "5.0|5.1",
                "product": {
                  "name": "BD FACSChorus (HP Z2 G9 workstation, shipped with FACSDiscover S8 Cell Sorter): 5.0|5.1",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "BD FACSChorus (HP Z2 G9 workstation, shipped with FACSDiscover S8 Cell Sorter)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "3.0|3.1",
                "product": {
                  "name": "BD FACSChorus (HP Z2 G5 workstation, shipped with FACSMelody Cell Sorter): 3.0|3.1",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "BD FACSChorus (HP Z2 G5 workstation, shipped with FACSMelody Cell Sorter)"
          }
        ],
        "category": "vendor",
        "name": "Becton, Dickinson and Company (BD)"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-29060",
      "cwe": {
        "id": "CWE-1299",
        "name": "Missing Protection Mechanism for Alternate Hardware Interface"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In BD FACSChorus v5.0, v5.1, v3.0, and v3.1, the respective workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor with physical access to the workstation could gain access to system information and potentially exfiltrate data.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-29060"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Vulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Check back periodically for updates.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "If the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Administrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "The vulnerabilities impact the BD FACSChorus v5.0, v5.1, v3.0, and v3.1and their workstations. None of the vulnerabilities above impact the operation or instrument functionality of the BD FACSDiscover S8 Cell Sorter or the BD FACSMelody Cell Sorter.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "For additional information, refer to BD\u0027s Security Bulletin.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://www.bd.com/content/bd-com/na/us/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2023-29061",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In the BD FACSChorus v5.0, v5.1, v3.0, and v3.1 workstation, there is no BIOS password. A threat actor with physical access to the workstation can potentially exploit this vulnerability to access the BIOS configuration and modify the drive boot order and BIOS pre-boot authentication.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-29061"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Vulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Check back periodically for updates.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "If the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Administrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "The vulnerabilities impact the BD FACSChorus v5.0, v5.1, v3.0, and v3.1and their workstations. None of the vulnerabilities above impact the operation or instrument functionality of the BD FACSDiscover S8 Cell Sorter or the BD FACSMelody Cell Sorter.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "For additional information, refer to BD\u0027s Security Bulletin.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://www.bd.com/content/bd-com/na/us/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2023-29062",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In BD FACSChorus v5.0, v5.1, v3.0, and v3.1, the operating system hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately validating the identity of the requested resource. This is possible through the use of LLMNR, MBT-NS, or MDNS and will result in NTLMv2 hashes being sent to a malicious entity position on the local network. These hashes can subsequently be attacked through brute force and cracked if a weak password is used. This attack would only apply to domain joined systems.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-29062"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Vulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Check back periodically for updates.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "If the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Administrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "The vulnerabilities impact the BD FACSChorus v5.0, v5.1, v3.0, and v3.1and their workstations. None of the vulnerabilities above impact the operation or instrument functionality of the BD FACSDiscover S8 Cell Sorter or the BD FACSMelody Cell Sorter.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "For additional information, refer to BD\u0027s Security Bulletin.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://www.bd.com/content/bd-com/na/us/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.8,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2023-29063",
      "cwe": {
        "id": "CWE-1299",
        "name": "Missing Protection Mechanism for Alternate Hardware Interface"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In BD FACSChorus v5.0, v5.1, v3.0, and v3.1, the workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PCI card designed for memory capture. A threat actor can isolate sensitive information such as a BitLocker encryption key from a dump of the workstation RAM during startup.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-29063"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Vulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Check back periodically for updates.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "If the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Administrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "The vulnerabilities impact the BD FACSChorus v5.0, v5.1, v3.0, and v3.1and their workstations. None of the vulnerabilities above impact the operation or instrument functionality of the BD FACSDiscover S8 Cell Sorter or the BD FACSMelody Cell Sorter.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "For additional information, refer to BD\u0027s Security Bulletin.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://www.bd.com/content/bd-com/na/us/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2023-29064",
      "cwe": {
        "id": "CWE-798",
        "name": "Use of Hard-coded Credentials"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In BD FACSChorus v5.0 and v5.1, the software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets used by the application, which include tokens and passwords for administrative accounts.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-29064"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Vulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Check back periodically for updates.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "If the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Administrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "The vulnerabilities impact the BD FACSChorus v5.0, v5.1, v3.0, and v3.1and their workstations. None of the vulnerabilities above impact the operation or instrument functionality of the BD FACSDiscover S8 Cell Sorter or the BD FACSMelody Cell Sorter.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "For additional information, refer to BD\u0027s Security Bulletin.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://www.bd.com/content/bd-com/na/us/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2023-29065",
      "cwe": {
        "id": "CWE-277",
        "name": "Insecure Inherited Permissions"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In BD FACSChorus v5.0 and v5.1, the software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical access could potentially gain credentials, which could be used to alter or destroy data stored in the database.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-29065"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Vulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Check back periodically for updates.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "If the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Administrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "The vulnerabilities impact the BD FACSChorus v5.0, v5.1, v3.0, and v3.1and their workstations. None of the vulnerabilities above impact the operation or instrument functionality of the BD FACSDiscover S8 Cell Sorter or the BD FACSMelody Cell Sorter.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "For additional information, refer to BD\u0027s Security Bulletin.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://www.bd.com/content/bd-com/na/us/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2023-29066",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "notes": [
        {
          "category": "summary",
          "text": "In BD FACSChorus v5.0 and v5.1 and the respective workstations, the software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account can modify information stored in the local application data folders.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-29066"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Vulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Check back periodically for updates.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "If the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Administrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "The vulnerabilities impact the BD FACSChorus v5.0, v5.1, v3.0, and v3.1and their workstations. None of the vulnerabilities above impact the operation or instrument functionality of the BD FACSDiscover S8 Cell Sorter or the BD FACSMelody Cell Sorter.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "For additional information, refer to BD\u0027s Security Bulletin.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://www.bd.com/content/bd-com/na/us/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.2,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    }
  ]
}

cve-2023-29061

Vulnerability from cvelistv5

Published

2023-11-28 20:33

Modified

2024-08-02 14:00

Severity ?

5.2 (Medium) - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Summary

Lack of Adequate BIOS Authentication

References

▼	URL	Tags
	https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software

Impacted products

▼	Vendor	Product
	Becton, Dickinson and Company (BD)	FACSChorus

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T14:00:14.960Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "64 bit"
          ],
          "product": "FACSChorus",
          "vendor": "Becton, Dickinson and Company (BD)",
          "versions": [
            {
              "lessThanOrEqual": "5.1",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.1",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-11-28T14:24:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "There is no BIOS password on the FACSChorus workstation. A threat actor with physical access to the workstation can potentially exploit this vulnerability to access the BIOS configuration and modify the drive boot order and BIOS pre-boot authentication."
            }
          ],
          "value": "There is no BIOS password on the FACSChorus workstation. A threat actor with physical access to the workstation can potentially exploit this vulnerability to access the BIOS configuration and modify the drive boot order and BIOS pre-boot authentication."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-28T20:33:44.065Z",
        "orgId": "2325d071-eabf-4b7b-a4ea-0819b6629a18",
        "shortName": "BD"
      },
      "references": [
        {
          "url": "https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Lack of Adequate BIOS Authentication",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cul\u003e\u003c/ul\u003e\n\n\n\nVulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Please check periodically for updates. Additionally, BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:\u003cbr\u003e\u003cul\u003e\u003cli\u003eEnsure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.\u003c/li\u003e\u003cli\u003eIf the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.\u003c/li\u003e\u003cli\u003eAdministrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "\n\n\n\n\nVulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Please check periodically for updates. Additionally, BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:\n  *  Ensure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.\n  *  If the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.\n  *  Administrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.\n\n\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2325d071-eabf-4b7b-a4ea-0819b6629a18",
    "assignerShortName": "BD",
    "cveId": "CVE-2023-29061",
    "datePublished": "2023-11-28T20:33:44.065Z",
    "dateReserved": "2023-03-30T21:10:17.526Z",
    "dateUpdated": "2024-08-02T14:00:14.960Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-29063

Vulnerability from cvelistv5

Published

2023-11-28 20:34

Modified

2024-08-02 14:00

Severity ?

2.4 (Low) - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

Lack of DMA Access Protections

References

▼	URL	Tags
	https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software

Impacted products

▼	Vendor	Product
	Becton, Dickinson and Company (BD)	FACSChorus

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T14:00:14.934Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "64 bit"
          ],
          "product": "FACSChorus",
          "vendor": "Becton, Dickinson and Company (BD)",
          "versions": [
            {
              "lessThanOrEqual": "5.1",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.1",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-11-28T14:24:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PCI card designed for memory capture. A threat actor can then isolate sensitive information such as a BitLocker encryption key from a dump of the workstation RAM during startup."
            }
          ],
          "value": "The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PCI card designed for memory capture. A threat actor can then isolate sensitive information such as a BitLocker encryption key from a dump of the workstation RAM during startup."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-121",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-121 Exploit Non-Production Interfaces"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1299",
              "description": "CWE-1299 Missing Protection Mechanism for Alternate Hardware Interface",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-28T20:34:59.290Z",
        "orgId": "2325d071-eabf-4b7b-a4ea-0819b6629a18",
        "shortName": "BD"
      },
      "references": [
        {
          "url": "https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Lack of DMA Access Protections",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\n\nVulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Please check periodically for updates. Additionally, BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:\u003cbr\u003e\u003cul\u003e\u003cli\u003eEnsure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.\u003c/li\u003e\u003cli\u003eIf the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.\u003c/li\u003e\u003cli\u003eAdministrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "\n\n\nVulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Please check periodically for updates. Additionally, BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:\n  *  Ensure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.\n  *  If the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.\n  *  Administrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.\n\n\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2325d071-eabf-4b7b-a4ea-0819b6629a18",
    "assignerShortName": "BD",
    "cveId": "CVE-2023-29063",
    "datePublished": "2023-11-28T20:34:59.290Z",
    "dateReserved": "2023-03-30T21:10:17.526Z",
    "dateUpdated": "2024-08-02T14:00:14.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-29065

Vulnerability from cvelistv5

Published

2023-11-28 20:35

Modified

2024-08-02 14:00

Severity ?

4.1 (Medium) - CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Summary

Overly Permissive Access Policy

References

▼	URL	Tags
	https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software

Impacted products

▼	Vendor	Product
	Becton, Dickinson and Company (BD)	FACSChorus

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T14:00:14.915Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "64 bit"
          ],
          "product": "FACSChorus",
          "vendor": "Becton, Dickinson and Company (BD)",
          "versions": [
            {
              "lessThanOrEqual": "5.1",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-11-28T14:24:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical access could potentially gain credentials, which could be used to alter or destroy data stored in the database."
            }
          ],
          "value": "The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical access could potentially gain credentials, which could be used to alter or destroy data stored in the database."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-277",
              "description": "CWE-277 Insecure Inherited Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-28T20:35:59.061Z",
        "orgId": "2325d071-eabf-4b7b-a4ea-0819b6629a18",
        "shortName": "BD"
      },
      "references": [
        {
          "url": "https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Overly Permissive Access Policy",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\n\nVulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Please check periodically for updates. Additionally, BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:\u003cbr\u003e\u003cul\u003e\u003cli\u003eEnsure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.\u003c/li\u003e\u003cli\u003eIf the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.\u003c/li\u003e\u003cli\u003eAdministrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "\n\n\nVulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Please check periodically for updates. Additionally, BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:\n  *  Ensure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.\n  *  If the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.\n  *  Administrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.\n\n\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2325d071-eabf-4b7b-a4ea-0819b6629a18",
    "assignerShortName": "BD",
    "cveId": "CVE-2023-29065",
    "datePublished": "2023-11-28T20:35:59.061Z",
    "dateReserved": "2023-03-30T21:10:17.527Z",
    "dateUpdated": "2024-08-02T14:00:14.915Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-29066

Vulnerability from cvelistv5

Published

2023-11-28 20:36

Modified

2024-08-02 14:00

Severity ?

3.2 (Low) - CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Summary

Incorrect User Management

References

▼	URL	Tags
	https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software

Impacted products

▼	Vendor	Product
	Becton, Dickinson and Company (BD)	FACSChorus

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T14:00:15.314Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "64 bit"
          ],
          "product": "FACSChorus",
          "vendor": "Becton, Dickinson and Company (BD)",
          "versions": [
            {
              "lessThanOrEqual": "5.1",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-11-28T14:24:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account can modify information stored in the local application data folders."
            }
          ],
          "value": "The FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account can modify information stored in the local application data folders."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-639",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-639 Probe System Files"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "CWE-266 Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-28T20:36:13.494Z",
        "orgId": "2325d071-eabf-4b7b-a4ea-0819b6629a18",
        "shortName": "BD"
      },
      "references": [
        {
          "url": "https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Incorrect User Management",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\n\nVulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Please check periodically for updates. Additionally, BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:\u003cbr\u003e\u003cul\u003e\u003cli\u003eEnsure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.\u003c/li\u003e\u003cli\u003eIf the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.\u003c/li\u003e\u003cli\u003eAdministrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "\n\n\nVulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Please check periodically for updates. Additionally, BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:\n  *  Ensure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.\n  *  If the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.\n  *  Administrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.\n\n\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2325d071-eabf-4b7b-a4ea-0819b6629a18",
    "assignerShortName": "BD",
    "cveId": "CVE-2023-29066",
    "datePublished": "2023-11-28T20:36:13.494Z",
    "dateReserved": "2023-03-30T21:10:17.527Z",
    "dateUpdated": "2024-08-02T14:00:15.314Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-29060

Vulnerability from cvelistv5

Published

2023-11-28 20:07

Modified

2024-08-02 14:00

Severity ?

5.4 (Medium) - CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Summary

Lack of USB Whitelisting

References

▼	URL	Tags
	https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software

Impacted products

▼	Vendor	Product
	Becton, Dickinson and Company (BD)	FACSChorus

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T14:00:14.601Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "64 bit"
          ],
          "product": "FACSChorus",
          "vendor": "Becton, Dickinson and Company (BD)",
          "versions": [
            {
              "lessThanOrEqual": "5.1",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.1",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-11-28T14:24:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor with physical access to the workstation could gain access to system information and potentially exfiltrate data."
            }
          ],
          "value": "The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor with physical access to the workstation could gain access to system information and potentially exfiltrate data."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-457",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-457 USB Memory Attacks"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1299",
              "description": "CWE-1299 Missing Protection Mechanism for Alternate Hardware Interface",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-28T20:31:55.731Z",
        "orgId": "2325d071-eabf-4b7b-a4ea-0819b6629a18",
        "shortName": "BD"
      },
      "references": [
        {
          "url": "https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Lack of USB Whitelisting",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Vulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Please check periodically for updates. Additionally, BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:\u003cbr\u003e\u003cul\u003e\u003cli\u003eEnsure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.\u003c/li\u003e\u003cli\u003eIf the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.\u003c/li\u003e\u003cli\u003eAdministrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "Vulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Please check periodically for updates. Additionally, BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:\n  *  Ensure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.\n  *  If the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.\n  *  Administrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.\n\n\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2325d071-eabf-4b7b-a4ea-0819b6629a18",
    "assignerShortName": "BD",
    "cveId": "CVE-2023-29060",
    "datePublished": "2023-11-28T20:07:00.245Z",
    "dateReserved": "2023-03-30T21:10:17.526Z",
    "dateUpdated": "2024-08-02T14:00:14.601Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-29062

Vulnerability from cvelistv5

Published

2023-11-28 20:34

Modified

2024-08-02 14:00

Severity ?

3.8 (Low) - CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Summary

Unsecure Identity Verification

References

▼	URL	Tags
	https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software

Impacted products

▼	Vendor	Product
	Becton, Dickinson and Company (BD)	FACSChorus

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T14:00:15.040Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "64 bit"
          ],
          "product": "FACSChorus",
          "vendor": "Becton, Dickinson and Company (BD)",
          "versions": [
            {
              "lessThanOrEqual": "5.1",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.1",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-11-28T14:24:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately validating the identity of the requested resource. This is possible through the use of LLMNR, MBT-NS, or MDNS and will result in NTLMv2 hashes being sent to a malicious entity position on the local network. These hashes can subsequently be attacked through brute force and cracked if a weak password is used. This attack would only apply to domain joined systems."
            }
          ],
          "value": "The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately validating the identity of the requested resource. This is possible through the use of LLMNR, MBT-NS, or MDNS and will result in NTLMv2 hashes being sent to a malicious entity position on the local network. These hashes can subsequently be attacked through brute force and cracked if a weak password is used. This attack would only apply to domain joined systems."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-194",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-194 Fake the Source of Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.8,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-28T20:34:22.945Z",
        "orgId": "2325d071-eabf-4b7b-a4ea-0819b6629a18",
        "shortName": "BD"
      },
      "references": [
        {
          "url": "https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unsecure Identity Verification",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cul\u003e\u003c/ul\u003e\n\n\n\nVulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Please check periodically for updates. Additionally, BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:\u003cbr\u003e\u003cul\u003e\u003cli\u003eEnsure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.\u003c/li\u003e\u003cli\u003eIf the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.\u003c/li\u003e\u003cli\u003eAdministrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "\n\n\n\n\nVulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Please check periodically for updates. Additionally, BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:\n  *  Ensure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.\n  *  If the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.\n  *  Administrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.\n\n\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2325d071-eabf-4b7b-a4ea-0819b6629a18",
    "assignerShortName": "BD",
    "cveId": "CVE-2023-29062",
    "datePublished": "2023-11-28T20:34:22.945Z",
    "dateReserved": "2023-03-30T21:10:17.526Z",
    "dateUpdated": "2024-08-02T14:00:15.040Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-29064

Vulnerability from cvelistv5

Published

2023-11-28 20:35

Modified

2024-10-11 17:57

Severity ?

4.1 (Medium) - CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Summary

Hardcoded Secrets

References

▼	URL	Tags
	https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software

Impacted products

▼	Vendor	Product
	Becton, Dickinson and Company (BD)	FACSChorus

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T14:00:15.704Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-29064",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-11T17:51:34.260250Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-11T17:57:54.519Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "64 bit"
          ],
          "product": "FACSChorus",
          "vendor": "Becton, Dickinson and Company (BD)",
          "versions": [
            {
              "lessThanOrEqual": "5.1",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-11-28T14:24:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The FACSChorus software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets used by the application, which include tokens and passwords for administrative accounts."
            }
          ],
          "value": "The FACSChorus software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets used by the application, which include tokens and passwords for administrative accounts."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-191",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-191 Read Sensitive Strings Within an Executable"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "CWE-798 Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-28T20:35:30.214Z",
        "orgId": "2325d071-eabf-4b7b-a4ea-0819b6629a18",
        "shortName": "BD"
      },
      "references": [
        {
          "url": "https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Hardcoded Secrets",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\n\nVulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Please check periodically for updates. Additionally, BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:\u003cbr\u003e\u003cul\u003e\u003cli\u003eEnsure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.\u003c/li\u003e\u003cli\u003eIf the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.\u003c/li\u003e\u003cli\u003eAdministrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "\n\n\nVulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Please check periodically for updates. Additionally, BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:\n  *  Ensure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.\n  *  If the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.\n  *  Administrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.\n\n\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2325d071-eabf-4b7b-a4ea-0819b6629a18",
    "assignerShortName": "BD",
    "cveId": "CVE-2023-29064",
    "datePublished": "2023-11-28T20:35:30.214Z",
    "dateReserved": "2023-03-30T21:10:17.526Z",
    "dateUpdated": "2024-10-11T17:57:54.519Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_cisa

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature