CVE-2023-29061

BD FACSChorus is affected by CVE-2023-29061 due to missing BIOS password on the workstation. In BD FACSChorus v5.0, v5.1, v3.0, and v3.1, a threat actor with physical access can access BIOS settings and modify boot order and pre-boot authentication. CVSS v3.1 base score 5.2 (AV:P, AC:L, PR:N, UI:...

CVE-2023-29060

CVE-2023-29060 describes a USB access control weakness in the BD FACSChorus workstation OS where the system does not restrict which USB devices can interact with ports. Affected products: BD FACSChorus on v5.0, v5.1, v3.0, and v3.1 workstations. Root cause: missing protection mechanism for altern...

CVE-2023-29063

BD FACSChorus CVE-2023-29063 describes a vulnerability where physical access to PCIe slots could allow a memory-capture PCI card to dump RAM and expose sensitive data (e.g., BitLocker keys) during startup. Affected products include BD FACSChorus workstations (v5.0/v5.1 and v3.0/v3.1). The issue s...

CVE-2023-29064

The CVE-2023-29064 issue affects BD FACSChorus software (versions v5.0/v5.1 and v3.0/v3.1) where sensitive information is stored in plaintext, enabling a threat actor to obtain hardcoded secrets such as tokens and passwords for administrative accounts. Root cause: use of plaintext storage for cre...

CVE-2023-29062

CVE-2023-29062 describes a vulnerability in the OS hosting BD FACSChorus where user credentials may be transmitted as NTLMv2 hashes via LLMNR, MBT-NS, or MDNS, if the identity of requested resources is not adequately validated. Affected products are BD FACSChorus software and workstations (versio...

CVE-2023-29065

CVE-2023-29065 relates to BD FACSChorus: on BD FACSChorus v5.0/v5.1 and workstation variants v3.0/v3.1, the software database can be accessed with the privileges of the currently logged-in user due to insecure inherited permissions. This could allow a threat actor with physical access to gain cre...

CVE-2023-29066

BD FACSChorus software (v5.0, v5.1, v3.0, v3.1) contains an improper privilege/permission handling flaw (CVE-2023-29066) where non-administrative OS accounts can modify data in local application folders. This root cause is described across multiple sources (NVD entry and CVE list) with a base sco...