CVE-2023-29064: medium-severity vulnerability in Becton, Dickinson and Company (BD) FACSChorus
Hardcoded Secrets
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
FACSChorus software stores sensitive login credentials and tokens directly in its code or configuration files in plain text. An attacker who gains access to these files can steal administrative passwords and tokens, compromising the entire application.
CWE-798 hardcoded credentials vulnerability in FACSChorus allows threat actors with access to application files or memory to extract plaintext administrative tokens and passwords. Pre-condition requires local or remote file access; impact includes unauthorized administrative access and full application compromise.
In the same product, most dangerous first.