CVE-2023-29063
2.4
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability: 0.9 / Impact: 1.4
Source: NVD
Description
The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PCI card designed for memory capture. A threat actor can then isolate sensitive information such as a BitLocker encryption key from a dump of the workstation RAM during startup.
Affected (4)
Products: Bd: Facschorus
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Version 5.0 |
| Running on/with | Platform Versions |
|---|---|
Hp Hp Z2 Tower G9 | All versions |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.0 |
| Running on/with | Platform Versions |
|---|---|
Hp Hp Z2 Tower G5 | All versions |
Related CWEs
CWE-1299
Missing Protection Mechanism for Alternate Hardware Interface
The lack of protections on alternate paths to access
control-protected assets (such as unprotected shadow registers
and other external facing unguarded interfaces) allows an
attacker to bypass existing protections to the asset that are
only performed against the primary path.
CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
References (2)
Source: cybersecurity@bd.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.