CVE-2023-49115
Assigner: icscert
Published: 2024-02-01T22:28:08.697Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: FeverWarn
vendor: MachineSense
versions: status: affected
version: ESP32
status: affected
version: RaspberryPi
status: affected
version: DataHub RaspberryPi
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Vera Mens of Claroty Research reported these vulnerabilities to CISA.
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">

<span style="background-color: rgb(255, 255, 255);">

<span style="background-color: rgb(255, 255, 255);">

<span style="background-color: rgb(255, 255, 255);">MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users.</span>

</span>

</span>

</span>


value: 






MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users.








metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-306
description: CWE-306 Missing Authentication for Critical Function
type: CWE
source: discovery: EXTERNAL
title: MachineSense FeverWarn Missing Authentication for Critical Function
workarounds: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">FeverWarn and the associated cloud service were pandemic-specific products for elevated body temperature scanning, discontinued by MachineSense prior to the end of the pandemic. They are no longer available, and there will be no future availability or upgrades. MachineSense is not aware of any current users of FeverWarn. Users of the affected product are encouraged to </span><a target="_blank" rel="nofollow" href="https://machinesense.com/pages/about-machinesense">contact MachineSense</a><span style="background-color: rgb(255, 255, 255);">&nbsp;for additional information.</span>

<br>
value: 
FeverWarn and the associated cloud service were pandemic-specific products for elevated body temperature scanning, discontinued by MachineSense prior to the end of the pandemic. They are no longer available, and there will be no future availability or upgrades. MachineSense is not aware of any current users of FeverWarn. Users of the affected product are encouraged to  contact MachineSense https://machinesense.com/pages/about-machinesense  for additional information.



x_generator: engine: Vulnogram 0.1.0-dev