CVE-2023-29062

Name: CVE-2023-29062
Creator: NVD / NIST
Published: 2023-11-28T21:15:07.44+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

LOWCVSS 3.8/10EPSS 0.30%

Last modified Jun 17, 2026

CVE-2023-29062 is a low-severity vulnerability rated 3.8/10 on the CVSS scale. The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately validating the identity of the requested resource. This is possible through the use of LLMNR, MBT-NS, or MDNS and will result in NTLMv2 hashes being sent to a malicious entity position on the local network. EPSS estimates a 0.30% chance of exploitation in the next 30 days.

Description

The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately validating the identity of the requested resource. This is possible through the use of LLMNR, MBT-NS, or MDNS and will result in NTLMv2 hashes being sent to a malicious entity position on the local network. These hashes can subsequently be attacked through brute force and cracked if a weak password is used. This attack would only apply to domain joined systems.

Metrics

CVSS 3.1

3.8/10

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

EPSS Probability

0.30%

21.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Bd	Facschorus	5.0
Bd	Facschorus	5.1
Bd	Facschorus	3.0
Bd	Facschorus	3.1

References

https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-softwareVendor Advisory
https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-softwareVendor Advisory

Timeline

Published: Nov 28, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-29062?

How severe is CVE-2023-29062?

CVE-2023-29062 has a CVSS score of 3.8/10 (LOW severity). The EPSS model estimates a 0.30% probability of exploitation in the next 30 days.

How do I fix CVE-2023-29062?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-29062?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST