CVE-2023-29062: low-severity vulnerability in Becton, Dickinson and Company (BD) FACSChorus
Unsecure Identity Verification
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The FACSChorus application's operating system can be tricked into sending user password hashes to a malicious device on the local network, which an attacker could then try to crack if the password is weak. This only affects computers that are joined to a company domain.
The OS hosting FACSChorus improperly validates resource identity, allowing LLMNR/mDNS/NBNS spoofing attacks that trigger transmission of NTLMv2 hashes to attacker-controlled network endpoints. Successful exploitation requires local network position and weak password entropy; impact is limited to domain-joined systems where offline brute-force attacks on captured hashes become feasible.
In the same product, most dangerous first.