CVE-2023-29060: medium-severity vulnerability in Becton, Dickinson and Company (BD) FACSChorus
Lack of USB Whitelisting
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.3%
In short
The FACSChorus workstation allows any USB device to connect without restrictions. An attacker with physical access could plug in a malicious USB device to steal system information or data from the computer.
Technical detail
The system lacks USB device whitelisting controls, allowing unauthorized USB peripherals to communicate with the workstation. An attacker with physical access can exploit this to enumerate system information and exfiltrate sensitive data via an arbitrary USB device.
Summary generated and translated by AI from the official description.
The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor with physical access to the workstation could gain access to system information and potentially exfiltrate data.
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Affected products
Becton, Dickinson and Company (BD) · FACSChorusRelated CVEs — Becton, Dickinson and Company (BD) FACSChorus
In the same product, most dangerous first.
CVE-2023-29061MEDIUMLack of Adequate BIOS AuthenticationEPSS 0.4%CVE-2023-29062LOWUnsecure Identity VerificationEPSS 0.3%CVE-2023-29065MEDIUMOverly Permissive Access PolicyEPSS 0.3%CVE-2023-29064MEDIUMHardcoded SecretsEPSS 0.3%CVE-2023-29066LOWIncorrect User ManagementEPSS 0.3%CVE-2023-29063LOWLack of DMA Access ProtectionsEPSS 0.2%