Vulnerability

BD FACSChorus workstations leave USB, BIOS and PCIe open and store admin secrets in plaintext

MedDevice Cyber Staff · Nov 27 · 4 min read · Via CISA ICSMA-23-331-01

CISA published advisory ICSMA-23-331-01 on November 27, 2023, covering BD FACSChorus software and the HP workstations it ships on: versions 3.0 and 3.1 on the HP Z2 G5 with the FACSMelody Cell Sorter, and 5.0 and 5.1 on the HP Z2 G9 with the FACSDiscover S8 Cell Sorter. Milind Sunilbhai Purswani, BD, and Michael Aguilar (v3ga) of Secureworks are credited.

Seven CVEs carry the advisory, none above 5.4, and most are workstation hardening gaps. CVE-2023-29060 (CWE-1299, 5.4): the operating system does not restrict which devices can use the USB ports. CVE-2023-29061 (CWE-306, 5.2): there is no BIOS password, so boot order and pre-boot authentication can be changed. CVE-2023-29063 (CWE-1299, 2.4): open PCIe slots allow a memory-capture card to pull a BitLocker key from RAM during startup.

The rest sit in the software. In 5.0 and 5.1, CVE-2023-29064 (CWE-798, 4.1) exposes hardcoded secrets, including tokens and passwords for administrative accounts, stored in plaintext. CVE-2023-29065 (CWE-277, 4.1) lets the database be accessed directly with the logged-in user's privileges. CVE-2023-29066 (CWE-266, 3.2) lets a non-administrative OS account modify local application data.

One flaw reaches the network. CVE-2023-29062 (CWE-287, 3.8) leaves LLMNR, NBT-NS or mDNS enabled, so a malicious host on the local network can collect NTLMv2 hashes and crack weak passwords. It only applies to domain-joined systems.

BD says none of the flaws affect operation of the cell sorters themselves, and that fixes will come in an upcoming release. Until then BD asks for physical access controls, standard network security on connected workstations, and strict control of administrative access.

A commodity PC shipped with commodity defaults hands anyone at the keyboard a head start. A BIOS password and a USB device policy cost nothing at the factory.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

BD will fix the FACSChorus 3.0, 3.1, 5.0 and 5.1 vulnerabilities in an upcoming release; there is no patch at publication. Restrict physical access to the workstations to authorized users, apply standard network security policies to any networked unit, and tightly control administrative access to the software and the workstation.

Restrict physical access. Only authorized users should reach the FACSChorus workstation, its USB ports and its PCIe slots.
Disable name-resolution fallbacks. On domain-joined workstations, turn off LLMNR, NBT-NS and mDNS where your IT policy allows, and enforce strong passwords.
Control administrative access. Limit admin rights on the software and the workstation under your local IT security policy.
Watch for BD's release. Check the BD bulletin and install the upcoming FACSChorus release when it ships.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Named operating system

Contributing

USB port Patient or study database User accounts Wired network

BD FACSChorus

PID-14 PID-3321 USB port Patient or study database User accounts Wired network

Fix the class in your product

The product exposes an interface with authentication off out of the box. As the maker, make the default configuration the secure configuration: require an admin credential before any interface serves data, and refuse to expose anything until setup is complete.

Default to authenticated. Block every data path until an admin credential is set on first boot.
Make insecure mode explicit. If an open mode must exist, it is a loud, logged, opt in choice, never the starting state.
Test the out of box state. Treat the shipped default as its own threat model.

Mapped EMB3D mitigations

Questions & Answers

Which BD FACSChorus versions are affected by CVE-2023-29060?

CISA advisory ICSMA-23-331-01, published November 27, 2023, lists BD FACSChorus 3.0 and 3.1 on the HP Z2 G5 workstation shipped with the FACSMelody Cell Sorter, and 5.0 and 5.1 on the HP Z2 G9 workstation shipped with the FACSDiscover S8 Cell Sorter.

Is there a patch for the BD FACSChorus vulnerabilities?

Not at publication. Per CISA advisory ICSMA-23-331-01, BD will address CVE-2023-29060 through CVE-2023-29066 in BD FACSChorus in an upcoming release and recommends physical access controls, network security policies and strict control of administrative access meanwhile.

Do the BD FACSChorus vulnerabilities affect the FACSMelody or FACSDiscover S8 cell sorters?

BD states none of the vulnerabilities in CISA advisory ICSMA-23-331-01 impact the operation or instrument functionality of the BD FACSDiscover S8 Cell Sorter or the BD FACSMelody Cell Sorter. They affect FACSChorus 3.0, 3.1, 5.0 and 5.1 and their workstations.

← Back to Vulnerabilities