{"id":"CVE-2023-6221","state":"PUBLISHED","title":"MachineSense FeverWarn  Missing Authentication for Critical Function","description":"\nThe cloud provider MachineSense uses for integration and deployment for multiple MachineSense devices, such as the programmable logic controller (PLC), PumpSense, PowerAnalyzer, FeverWarn, and others is insufficiently protected against unauthorized access. An attacker with access to the internal procedures could view source code, secret credentials, and more.\n\n","publishedAt":"2024-02-01T22:18:31.089Z","updatedAt":"2025-05-15T19:51:24.142Z","severity":{"score":7.7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","source":"icscert"},"assigner":"icscert","products":["MachineSense FeverWarn"],"affected":[{"vendor":"MachineSense","product":"FeverWarn","defaultStatus":"unaffected","versions":[{"version":"ESP32","status":"affected"},{"version":"RaspberryPi","status":"affected"},{"version":"DataHub RaspberryPi","status":"affected"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01","https://machinesense.com/pages/about-machinesense"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/6xxx/CVE-2023-6221.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-6221","state":"PUBLISHED","datePublished":"2024-02-01T22:18:31.089Z","dateUpdated":"2025-05-15T19:51:24.142Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2023-11-20T18:36:30.804Z"},"containers":{"cna":{"title":"MachineSense FeverWarn  Missing Authentication for Critical Function","descriptions":[{"lang":"en","value":"\nThe cloud provider MachineSense uses for integration and deployment for multiple MachineSense devices, such as the programmable logic controller (PLC), PumpSense, PowerAnalyzer, FeverWarn, and others is insufficiently protected against unauthorized access. An attacker with access to the internal procedures could view source code, secret credentials, and more.\n\n"}],"affected":[{"vendor":"MachineSense","product":"FeverWarn","defaultStatus":"unaffected","versions":[{"version":"ESP32","status":"affected"},{"version":"RaspberryPi","status":"affected"},{"version":"DataHub RaspberryPi","status":"affected"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01"},{"url":"https://machinesense.com/pages/about-machinesense"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2024-02-01T22:18:31.089Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Vera Mens of Claroty Research reported these vulnerabilities to CISA."}],"source":{"discovery":"EXTERNAL"},"tags":["unsupported-when-assigned"],"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"\n\n<span style=\"background-color: rgb(255, 255, 255);\">FeverWarn and the associated cloud service were pandemic-specific products for elevated body temperature scanning, discontinued by MachineSense prior to the end of the pandemic. They are no longer available, and there will be no future availability or upgrades. MachineSense is not aware of any current users of FeverWarn. Users of the affected product are encouraged to </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://machinesense.com/pages/about-machinesense\">contact MachineSense</a><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;for additional information.</span>\n\n<br>"}],"value":"\nFeverWarn and the associated cloud service were pandemic-specific products for elevated body temperature scanning, discontinued by MachineSense prior to the end of the pandemic. They are no longer available, and there will be no future availability or upgrades. MachineSense is not aware of any current users of FeverWarn. Users of the affected product are encouraged to  contact MachineSense https://machinesense.com/pages/about-machinesense  for additional information.\n\n\n"}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01","tags":["x_transferred"]},{"url":"https://machinesense.com/pages/about-machinesense","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T08:21:18.044Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-08T15:50:13.032598Z","id":"CVE-2023-6221","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-15T19:51:24.142Z"}}]}}}