title: Lack of Adequate BIOS Authentication
description: There is no BIOS password on the FACSChorus workstation. A threat actor with physical access to the workstation can potentially exploit this vulnerability to access the BIOS configuration and modify the drive boot order and BIOS pre-boot authentication.
problem types: CWE-306 Missing Authentication for Critical Function
affected:
{
defaultStatus: unaffected
platforms: [Windows, 64 bit]
product: FACSChorus
vendor: Becton, Dickinson and Company (BD)
versions:
lessThanOrEqual: 5.1, status: affected, version: 5.0, versionType: custom
lessThanOrEqual: 3.1, status: affected, version: 3.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 5.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
workarounds:
Vulnerabilities associated with the BD FACSChorus software and workstations will be addressed in an upcoming release. This bulletin will be updated when more information is available. Please check periodically for updates. Additionally, BD recommends the following mitigations and compensating controls to reduce risk associated with these vulnerabilities. The following recommendations apply to all vulnerabilities listed in this bulletin:
*  Ensure physical access controls are in place and only authorized end-users have access to the BD FACSChorus Software and respective workstation.
*  If the BD FACSChorus workstation is connected to the local network, ensure industry standard network security policies and procedures are followed.
*  Administrative access to the FACSChorus software and workstation should be strictly controlled by the customer in collaboration with their local IT security policy.