Vulnerability identifier: #VU85830

Vulnerability risk: Medium

CVSSv3.1: 8.1 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2023-47867

CWE-ID: CWE-284

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
FeverWarn ESP32
Hardware solutions / Medical equipment
FeverWarn RaspberryPi
Hardware solutions / Medical equipment
FeverWarn DataHub RaspberryPi
Hardware solutions / Medical equipment

Vendor: MachineSense

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker on the local network can connect to the device's web services and compromise the device.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

FeverWarn ESP32: All versions

FeverWarn RaspberryPi: All versions

FeverWarn DataHub RaspberryPi: All versions

---

External links
http://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.