OTPulse

BD FACSChorus

MonitorCVSS 5.4ICS-CERT ICSMA-23-331-01Nov 28, 2023
Attack path
Attack VectorPhysical
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

BD FACSChorus software (versions 3.0, 3.1, 5.0, 5.1) running on HP Z2 workstations contains multiple weaknesses in authentication, authorization, and access control. These allow a local user with low privileges to modify system configurations, access sensitive information, or escalate privileges. The vulnerabilities stem from hardcoded credentials (CWE-798), missing authentication checks (CWE-306), weak authorization enforcement (CWE-287), and improper access controls (CWE-266, CWE-277). The underlying FACSDiscover S8 and FACSMelody cell sorter instruments are not affected and continue to operate normally.

What this means
What could happen
An attacker with physical access to the FACSChorus workstation could modify system configurations, extract sensitive information, or bypass administrative controls. The cell sorter instruments themselves are not affected and will continue to operate normally.
Who's at risk
Flow cytometry laboratory operators and IT staff responsible for BD FACSChorus workstations in research and clinical settings. Specifically affects organizations using FACSDiscover S8 Cell Sorter with HP Z2 G9 workstations or FACSMelody Cell Sorter with HP Z2 G5 workstations. The cell sorter instruments themselves are not vulnerable.
How it could be exploited
An attacker must have physical access to the workstation and local user credentials to access the FACSChorus software. Once authenticated, they can modify system settings, access sensitive data stored on the workstation, or escalate privileges to administrative level due to weak access controls.
Prerequisites
  • Physical access to the BD FACSChorus workstation
  • Local user account credentials for the workstation or FACSChorus software
  • Low complexity attack requiring only standard user interaction
No patch availableRequires physical access and credentialsLow exploit probability (0.1% EPSS)Not actively exploitedWeak authentication and authorization mechanisms
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (2)
2 EOL
ProductAffected VersionsFix Status
BD FACSChorus (HP Z2 G9 workstation, shipped with FACSDiscover S8 Cell Sorter): 5.0|5.15.0|5.1No fix (EOL)
BD FACSChorus (HP Z2 G5 workstation, shipped with FACSMelody Cell Sorter): 3.0|3.13.0|3.1No fix (EOL)
Remediation & Mitigation
0/5
Do now
0/2
HARDENINGImplement strict physical access controls to the BD FACSChorus workstations; only authorized personnel should be able to reach the device
HARDENINGEnforce strong administrative access controls within FACSChorus software and the workstation through local IT security policy
Schedule — requires maintenance window
0/3

Patching may require device reboot — plan for process interruption

HARDENINGIsolate the FACSChorus workstation from the local network if it does not require network connectivity, or place it behind a firewall with restricted access if network connection is necessary
HARDENINGApply industry-standard network security policies and procedures if the workstation is connected to the network
HOTFIXMonitor for and apply BD software updates when vendor releases a patch for these vulnerabilities
View full CISA ICS-CERT advisory
API: /api/v1/advisories/c5bd33d0-37e8-40e5-9b41-930dffa56c3f

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

BD FACSChorus | CVSS 5.4 - OTPulse