CVE-2023-47867 MachineSense FeverWarn Improper Access Control
Attackers within Wi-Fi range can connect to FeverWarn devices and compromise them due to improper access control on web services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-47867?
CVE-2023-47867 is a high-severity missing authorization vulnerability in MachineSense FeverWarn, published on 1 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
MachineSense FeverWarn devices are configured as Wi-Fi hosts in a way that attackers within range could connect to the device's web services and compromise the device.
Weakness: CWE-284
Which versions are affected by CVE-2023-47867?
It affects 1 product.
Products include Machinesense Feverwarn Firmware.
How do I fix CVE-2023-47867?
No fix has been published for CVE-2023-47867 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-47867 being exploited?
There is no known exploitation of CVE-2023-47867 in the wild and no public exploit code.
Other vulnerabilities in MachineSense FeverWarn
- CVE-2023-49617 MachineSense FeverWarn Missing Authentication for Critical Function
- CVE-2023-46706 MachineSense FeverWarn Use of Hard-coded Credentials
- CVE-2023-49610 MachineSense FeverWarn Improper Input Validation
- CVE-2023-6221 MachineSense FeverWarn Missing Authentication for Critical Function
- CVE-2023-49115 MachineSense FeverWarn Missing Authentication for Critical Function
Sources
Also known as GHSA-h9g9-92v6-jw8x.