CVE-2023-29060
5.7
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Exploitability: 0.9 / Impact: 4.7
Source: NVD
Description
The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor with physical access to the workstation could gain access to system information and potentially exfiltrate data.
Affected (4)
Products: Bd: Facschorus
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Version 5.0 |
| Running on/with | Platform Versions |
|---|---|
Hp Hp Z2 Tower G9 | All versions |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.0 |
| Running on/with | Platform Versions |
|---|---|
Hp Hp Z2 Tower G5 | All versions |
Related CWEs
CWE-1299
Missing Protection Mechanism for Alternate Hardware Interface
The lack of protections on alternate paths to access
control-protected assets (such as unprotected shadow registers
and other external facing unguarded interfaces) allows an
attacker to bypass existing protections to the asset that are
only performed against the primary path.
CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
References (2)
Source: cybersecurity@bd.com
MitigationVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationVendor Advisory
Timeline
No history available yet.