CVE-2023-29066 - CVE House

Status published Low CVE-2023-29066

Incorrect User Management

3.2 CVSS

Vulnerability Description

The FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account can modify information stored in the local application data folders.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-29066

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software

More from Becton, Dickinson and Company (BD)

View All →

CVE-2023-29065

Overly Permissive Access Policy

Lack of DMA Access Protections

Low 2.4

CVE-2023-29062

Unsecure Identity Verification

Low 3.8

CVE-2023-29061

Lack of Adequate BIOS Authentication

Medium 5.2

Affected Vendor

Becton, Dickinson and Company (BD)

View all reports →

Affected Software

FACSChorus

Vulnerable Versions:

5.0

Timeline

Official Publish: November 28th, 2023

Last Modified: February 25th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weaknesses (CWE)

CWE-266

MITRE ATT&CK TTPs

T1078 Valid Accounts

Persistence

T1098 Account Manipulation

Privilege Escalation

T1548 Abuse Elevation Control Mechanism