CVE-2023-29066lowCWE-266

CVE-2023-29066: low-severity vulnerability in Becton, Dickinson and Company (BD) FACSChorus

Incorrect User Management

Published · Updated

Follow this CVE+ Monitor FACSChorus

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.2epss 0.3%
In short

FACSChorus software fails to properly restrict who can access and modify application data folders on the computer. This allows regular user accounts to change important application information that should only be editable by administrators.

Technical detail

CWE-266 involves improper privilege assignment in operating system user account management. A local non-administrative OS user can modify data in application folders due to insufficient discretionary access control (DAC) settings, potentially compromising application integrity without requiring elevated privileges.

Summary generated and translated by AI from the official description.
The FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account can modify information stored in the local application data folders.
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Affected products
Becton, Dickinson and Company (BD) · FACSChorus
Related CVEs — Becton, Dickinson and Company (BD) FACSChorus

In the same product, most dangerous first.

CVE-2023-29061MEDIUMLack of Adequate BIOS AuthenticationEPSS 0.4%CVE-2023-29060MEDIUMLack of USB WhitelistingEPSS 0.3%CVE-2023-29062LOWUnsecure Identity VerificationEPSS 0.3%CVE-2023-29065MEDIUMOverly Permissive Access PolicyEPSS 0.3%CVE-2023-29064MEDIUMHardcoded SecretsEPSS 0.3%CVE-2023-29063LOWLack of DMA Access ProtectionsEPSS 0.2%