CVE-2023-29062

LowCVSS 3.8/10Last modified Jun 17, 2026

Description

The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately validating the identity of the requested resource. This is possible through the use of LLMNR, MBT-NS, or MDNS and will result in NTLMv2 hashes being sent to a malicious entity position on the local network. These hashes can subsequently be attacked through brute force and cracked if a weak password is used. This attack would only apply to domain joined systems.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Nov 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-290632.4The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PC CVE-2023-290644.3The FACSChorus software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets used by the applicat CVE-2023-290654.3The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical CVE-2023-290663.5The FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account CVE-2023-290677.8A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 could lead to memory corruption vulnerability by write access vio CVE-2023-290687.8A maliciously crafted file consumed through pskernel.dll file could lead to memory corruption vulnerabilities. These vulnerabilities in conj CVE-2023-290697.8A maliciously crafted DLL file can be forced to install onto a non-default location, and attacker can overwrite parts of the product with ma CVE-2023-29079.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Marksoft allows SQL Injection. This i CVE-2023-290739.8A maliciously crafted MODEL file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow. A mal CVE-2023-290749.8A maliciously crafted CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write. A malicio CVE-2023-290759.8A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write. A malicious a CVE-2023-290769.8A maliciously crafted MODEL, SLDASM, SAT or CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 could cause memory corruption vu