Vulnerability · Published Feb 1, 2024 · Assigned by icscert

CVE-2023-6221MachineSense FeverWarn Missing Authentication for Critical Function

High 7.7

In plain English

A high-severity missing authentication in FeverWarn from MachineSense. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.6%top 52.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The cloud provider MachineSense uses for integration and deployment for multiple MachineSense devices, such as the programmable logic controller (PLC), PumpSense, PowerAnalyzer, FeverWarn, and others is insufficiently protected against unauthorized access. An attacker with access to the internal procedures could view source code, secret credentials, and more.

Affected products (as reported)

Vendor	Product	Versions
MachineSense	FeverWarn	ESP32RaspberryPiDataHub RaspberryPi

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

In plain English

Official description

Affected products (as reported)

References