CISA also recommends users take the following measures to protect themselves from social engineering attacks:
Do not click web links or open attachments in unsolicited email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
Credit: Vera Mens (Claroty Research)
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2023-49617 | CWE-306 Missing Authentication for Critical Function | 10.0 Critical |
The MachineSense application programmable interface (API) is improperly protected and can be accessed without authentication. A remote attacker could retrieve and modify sensitive information without any authentication. Mitigation: FeverWarn and the associated cloud service were pandemic-specific products for elevated body temperature scanning, discontinued by MachineSense prior to the end of the pandemic. They are no longer available, and there will be no future availability or upgrade… ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-46706 | CWE-798 Use of Hard-coded Credentials | 9.1 Critical |
Multiple MachineSense devices have credentials unable to be changed by the user or administrator. Mitigation: FeverWarn and the associated cloud service were pandemic-specific products for elevated body temperature scanning, discontinued by MachineSense prior to the end of the pandemic. They are no longer available, and there will be no future availability or upgrade… ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-47867 | CWE-284 Improper Access Control | 8.8 High |
MachineSense FeverWarn devices are configured as Wi-Fi hosts in a way that attackers within range could connect to the device's web services and compromise the device. Mitigation: FeverWarn and the associated cloud service were pandemic-specific products for elevated body temperature scanning, discontinued by MachineSense prior to the end of the pandemic. They are no longer available, and there will be no future availability or upgrade… ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-49610 | CWE-20 Improper Input Validation | 8.1 High |
MachineSense FeverWarn Raspberry Pi-based devices lack input sanitization, which could allow an attacker on an adjacent network to send a message running commands or could overflow the stack. Mitigation: FeverWarn and the associated cloud service were pandemic-specific products for elevated body temperature scanning, discontinued by MachineSense prior to the end of the pandemic. They are no longer available, and there will be no future availability or upgrade… ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-6221 | CWE-306 Missing Authentication for Critical Function | 7.7 High |
The cloud provider MachineSense uses for integration and deployment for multiple MachineSense devices, such as the programmable logic controller (PLC), PumpSense, PowerAnalyzer, FeverWarn, and others is insufficiently protected against unauthorized access. An attacker with access to the internal procedures could view source code, secret credentials, and more. Mitigation: FeverWarn and the associated cloud service were pandemic-specific products for elevated body temperature scanning, discontinued by MachineSense prior to the end of the pandemic. They are no longer available, and there will be no future availability or upgrade… ↗ Affected, fixed & timelineAffected:
|
| CVE-2023-49115 | CWE-306 Missing Authentication for Critical Function | 7.5 High |
MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users. Mitigation: FeverWarn and the associated cloud service were pandemic-specific products for elevated body temperature scanning, discontinued by MachineSense prior to the end of the pandemic. They are no longer available, and there will be no future availability or upgrade… ↗ Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2023-49617 | 10.0 Critical | MachineSense FeverWarn The MachineSense application programmable interface (API) is improperly protected and can be accessed without authentication. A remote attacker … |
| CVE-2023-46706 | 9.1 Critical | MachineSense FeverWarn Multiple MachineSense devices have credentials unable to be changed by the user or administrator. |
| CVE-2023-47867 | 8.8 High | MachineSense FeverWarn MachineSense FeverWarn devices are configured as Wi-Fi hosts in a way that attackers within range could connect to the device's web services… |
| CVE-2023-49610 | 8.1 High | MachineSense FeverWarn MachineSense FeverWarn Raspberry Pi-based devices lack input sanitization, which could allow an attacker on an adjacent network to send a … |
| CVE-2023-6221 | 7.7 High | MachineSense FeverWarn The cloud provider MachineSense uses for integration and deployment for multiple MachineSense devices, such as the programmable logic controller (PL… |
| CVE-2023-49115 | 7.5 High | MachineSense FeverWarn MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users. |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.