CVE-2023-29060

2023-11-2820:15:07

CWE-306

CWE-1299

[email protected]

web.nvd.nist.gov

facschorus

usb ports

vulnerability

data exfiltration

threat actor

physical access

system information

CVSS3

5.7

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

EPSS

Percentile

12.7%

JSON

The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor with physical access to the workstation could gain access to system information and potentially exfiltrate data.

Affected configurations

Nvd

Node

hphp_z2_tower_g9Match-

AND

bdfacschorusMatch5.0

bdfacschorusMatch5.1

Node

hphp_z2_tower_g5Match-

AND

bdfacschorusMatch3.0

bdfacschorusMatch3.1

VendorProductVersionCPE
hphp_z2_tower_g9-cpe:2.3:h:hp:hp_z2_tower_g9:-:*:*:*:*:*:*:*
bdfacschorus5.0cpe:2.3:a:bd:facschorus:5.0:*:*:*:*:*:*:*
bdfacschorus5.1cpe:2.3:a:bd:facschorus:5.1:*:*:*:*:*:*:*
hphp_z2_tower_g5-cpe:2.3:h:hp:hp_z2_tower_g5:-:*:*:*:*:*:*:*
bdfacschorus3.0cpe:2.3:a:bd:facschorus:3.0:*:*:*:*:*:*:*
bdfacschorus3.1cpe:2.3:a:bd:facschorus:3.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hp	hp_z2_tower_g9	-	cpe:2.3:h:hp:hp_z2_tower_g9:-:::::::*
bd	facschorus	5.0	cpe:2.3:a:bd:facschorus:5.0:::::::*
bd	facschorus	5.1	cpe:2.3:a:bd:facschorus:5.1:::::::*
hp	hp_z2_tower_g5	-	cpe:2.3:h:hp:hp_z2_tower_g5:-:::::::*
bd	facschorus	3.0	cpe:2.3:a:bd:facschorus:3.0:::::::*
bd	facschorus	3.1	cpe:2.3:a:bd:facschorus:3.1:::::::*