CVE-2023-49115 MachineSense FeverWarn Missing Authentication for Critical Function
Attackers can access sensor data and monitor devices via unauthenticated MQTT messaging on MachineSense FeverWarn systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-49115?
CVE-2023-49115 is a high-severity missing authorization vulnerability in MachineSense FeverWarn, published on 1 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users.
Weakness: CWE-306
Which versions are affected by CVE-2023-49115?
It affects 1 product.
Products include Machinesense Feverwarn Firmware.
How do I fix CVE-2023-49115?
No fix has been published for CVE-2023-49115 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-49115 being exploited?
There is no known exploitation of CVE-2023-49115 in the wild and no public exploit code.
Other vulnerabilities in MachineSense FeverWarn
- CVE-2023-49617 MachineSense FeverWarn Missing Authentication for Critical Function
- CVE-2023-46706 MachineSense FeverWarn Use of Hard-coded Credentials
- CVE-2023-47867 MachineSense FeverWarn Improper Access Control
- CVE-2023-49610 MachineSense FeverWarn Improper Input Validation
- CVE-2023-6221 MachineSense FeverWarn Missing Authentication for Critical Function
Sources
Also known as GHSA-q7xm-vq7m-w9hh.