CVE-2023-6221 MachineSense FeverWarn Missing Authentication for Critical Function
An attacker with internal access can view source code and secret credentials due to missing authentication on the cloud integration platform.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-6221?
CVE-2023-6221 is a high-severity missing authorization vulnerability in MachineSense FeverWarn, published on 1 Feb 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The cloud provider MachineSense uses for integration and deployment for multiple MachineSense devices, such as the programmable logic controller (PLC), PumpSense, PowerAnalyzer, FeverWarn, and others is insufficiently protected against unauthorized access. An attacker with access to the internal procedures could view source code, secret credentials, and more.
Weakness: CWE-306
Which versions are affected by CVE-2023-6221?
It affects 1 product.
Products include Machinesense Feverwarn Firmware.
How do I fix CVE-2023-6221?
No fix has been published for CVE-2023-6221 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-6221 being exploited?
There is no known exploitation of CVE-2023-6221 in the wild and no public exploit code.
Other vulnerabilities in MachineSense FeverWarn
- CVE-2023-49617 MachineSense FeverWarn Missing Authentication for Critical Function
- CVE-2023-46706 MachineSense FeverWarn Use of Hard-coded Credentials
- CVE-2023-47867 MachineSense FeverWarn Improper Access Control
- CVE-2023-49610 MachineSense FeverWarn Improper Input Validation
- CVE-2023-49115 MachineSense FeverWarn Missing Authentication for Critical Function
Sources
Also known as GHSA-cxwq-x5m7-2p4v.