CVE-2023-29062

The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately validating the identity of the requested resource. This is possible through the use of LLMNR, MBT-NS, or MDNS and will result in NTLMv2 hashes being sent to a malicious entity position on the local network. These hashes can subsequently be attacked through brute force and cracked if a weak password is used. This attack would only apply to domain joined systems.

• CWE-287
• CWE-287

• https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-softwareVendor Advisory
• https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-softwareVendor Advisory

Published

Nov 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-29057A valid XCC user's local account permissions overrides their…8.8
• CVE-2023-29058A valid, authenticated XCC user with read-only permissions c…6.5
• CVE-2023-290593CX DesktopApp through 18.12.416 has embedded malicious code…7.8
• CVE-2023-2906Due to a failure in validating the length provided by an att…6.5
• CVE-2023-29060The FACSChorus workstation operating system does not restric…5.7
• CVE-2023-29061There is no BIOS password on the FACSChorus workstation. A t…5.2
• CVE-2023-29063The FACSChorus workstation does not prevent physical access …2.4
• CVE-2023-29064The FACSChorus software contains sensitive information store…4.3
• CVE-2023-29065The FACSChorus software database can be accessed directly wi…4.3
• CVE-2023-29066The FACSChorus software does not properly assign data access…3.5
• CVE-2023-29067A maliciously crafted X_B file when parsed through Autodesk®…7.8
• CVE-2023-29068A maliciously crafted file consumed through pskernel.dll fil…7.8