TI-2023-25195 CVE-2023-46706 · GHSA-mh9r-mh3m-pcgq
MachineSense FeverWarn Use of Hard-coded Credentials
Priority MEDIUM 50
Multiple MachineSense devices have credentials unable to be changed by the user or administrator.
MachineSense
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
MachineSense records in CISA KEVNo MachineSense vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records
TI-2023-27098 CVE-2023-49617 · GHSA-57qm-6jgh-x438
MachineSense FeverWarn Missing Authentication for Critical Function
Priority MEDIUM 44
The MachineSense application programmable interface (API) is improperly protected and can be accessed without authentication.
TI-2023-26780 CVE-2023-49115 · GHSA-q7xm-vq7m-w9hh
MachineSense FeverWarn Missing Authentication for Critical Function
Priority MEDIUM 40
MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users.
TI-2023-25971 CVE-2023-47867 · GHSA-h9g9-92v6-jw8x
MachineSense FeverWarn Improper Access Control
Priority LOW 38
MachineSense FeverWarn devices are configured as Wi-Fi hosts in a way that attackers within range could connect to the device's web services and compromise the device.
TI-2023-27095 CVE-2023-49610 · GHSA-xc99-434w-j882
MachineSense FeverWarn Improper Input Validation
Priority LOW 35
MachineSense FeverWarn Raspberry Pi-based devices lack input sanitization, which could allow an attacker on an adjacent network to send a message running commands or could overflow the stack.
TI-2023-05714 CVE-2023-6221 · GHSA-cxwq-x5m7-2p4v
MachineSense FeverWarn Missing Authentication for Critical Function
Priority LOW 34
The cloud provider MachineSense uses for integration and deployment for multiple MachineSense devices, such as the programmable logic controller (PLC), PumpSense, PowerAnalyzer, FeverWarn, and others is insufficiently pr…