MachineSense FeverWarn

🗓️ 25 Jan 2024 07:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 54 Views

Vulnerabilities in MachineSense FeverWarn incl. Missing Authentication, Hard-coded Credentials, Improper Access Control, OS Command Injection

Reporter	Title	Published	Views	Family All 65
BDU FSTEC	The vulnerabilities of the microprogramming software for thermal scanning systems—FeverWarn ESP32, FeverWarn RaspberryPi, and the FeverWarn DataHub RaspberryPi system for centralized data storage and management—allow a intruder to execute arbitrary commands or trigger failures.	2 Feb 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerabilities of microprogramming software in thermal scanning systems like FeverWarn ESP32, FeverWarn RaspberryPi, and the FeverWarn DataHub RaspberryPi system for centralized data storage and management, allowing intruders to enhance their privileges.	2 Feb 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerabilities of microprogramming software in FeverWarn ESP32, FeverWarn RaspberryPi, and the FeverWarn DataHub RaspberryPi systems allow a intruder to gain unauthorized access to protected information, execute arbitrary code, and gain full control over the device.	2 Feb 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerabilities of the API interfaces of microprogramming software for thermal scanning systems like FeverWarn ESP32, FeverWarn RaspberryPi, and the FeverWarn DataHub RaspberryPi, which allow attackers to gain unauthorized access to protected information.	2 Feb 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the MachineSense microprogramming software components in FeverWarn ESP32, FeverWarn RaspberryPi, and the FeverWarn DataHub RaspberryPi systems, which allows a intruder to gain unauthorized access to protected information.	2 Feb 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerabilities of microprogramming software in FeverWarn ESP32, FeverWarn RaspberryPi systems, and FeverWarn DataHub RaspberryPi, a system for centralized data storage and management, allow attackers to gain unauthorized access to protected information.	2 Feb 202400:00	–	bdu_fstec
Circl	CVE-2023-46706	2 Feb 202400:26	–	circl
Circl	CVE-2023-47867	2 Feb 202400:26	–	circl
Circl	CVE-2023-49115	2 Feb 202400:26	–	circl
Circl	CVE-2023-49610	2 Feb 202400:26	–	circl

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-025-01.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-24-025-01
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
us-cert	www.us-cert.cisa.gov/ics/Recommended-Practices
cisa	www.cisa.gov/ics
cisa	www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
cisa	www.cisa.gov/uscert/ncas/tips/ST04-014
cisa	www.cisa.gov/resources-tools/resources/ics-recommended-practices
cisa	www.cisa.gov/topics/industrial-control-systems
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

25 Jan 2024 07:00Current

9.2High risk

Vulners AI Score9.2

CVSS 3.19.8 - 10

EPSS0.0032

SSVC