CVE-2023-49617 MachineSense FeverWarn Missing Authentication for Critical Function
Remote attackers can access the MachineSense FeverWarn API without authentication to retrieve and modify sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-49617?
CVE-2023-49617 is a critical missing authorization vulnerability in MachineSense FeverWarn, published on 1 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The MachineSense application programmable interface (API) is improperly protected and can be accessed without authentication. A remote attacker could retrieve and modify sensitive information without any authentication.
Weakness: CWE-306
Which versions are affected by CVE-2023-49617?
It affects 1 product.
Products include Machinesense Feverwarn Firmware.
How do I fix CVE-2023-49617?
No fix has been published for CVE-2023-49617 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-49617 being exploited?
There is no known exploitation of CVE-2023-49617 in the wild and no public exploit code.
Other vulnerabilities in MachineSense FeverWarn
- CVE-2023-46706 MachineSense FeverWarn Use of Hard-coded Credentials
- CVE-2023-47867 MachineSense FeverWarn Improper Access Control
- CVE-2023-49610 MachineSense FeverWarn Improper Input Validation
- CVE-2023-6221 MachineSense FeverWarn Missing Authentication for Critical Function
- CVE-2023-49115 MachineSense FeverWarn Missing Authentication for Critical Function
Sources
Also known as GHSA-57qm-6jgh-x438.