CVE-2023-46706CWE-798

MachineSense FeverWarn Use of Hard-coded Credentials

Critical · published February 1, 2024

CVSS v3.1
9.1
EPSS
1%
Percentile
50.6
In the wild
Unconfirmed
What it is

🔥 Imagine having a powerful tool but being locked out of the control room! Unfortunately, that's the reality for users of Multiple MachineSense devices with unchangeable default credentials. ⚠️ Think of it like a fancy hotel room where the front desk keeps the only key. You can't change the lock or even request a new key, leaving anyone with the original key free to wander in and out without your permission. This vulnerability is absolutely devastating! An attacker could use those unchanged credentials to access sensitive functions and data, potentially compromising your entire system. With a CVSS score of 9.1, this situation demands immediate attention to ensure the safety of your devices and data.

Put simply

Think of it like a fancy hotel room where the front desk keeps the only key. You can't change the lock or even request a new key, leaving anyone with the original key free to wander in and out without your permission. The vulnerability exists because MachineSense devices have hardcoded credentials that cannot be altered by users or administrators, effectively leaving the door wide open for unauthorized access.

What to do

This vulnerability is absolutely devastating! An attacker could use those unchanged credentials to access sensitive functions and data, potentially compromising your entire system. With a CVSS score of 9.1, this situation demands immediate attention to ensure the safety of your devices and data. Reach out to MachineSense for guidance on securing your devices and inquire about any patches or workarounds that may be available. As a best practice, consider isolating these devices from critical systems until you can ensure their security. 🚨 You've got this! With a proactive approach, you can take control of your security and protect your system. 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00652 · 50.6th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2024-02-01T22:24Z
EPSS history
Timeline
  • 01 FEB 22:24Z
    MachineSense FeverWarn Use of Hard-coded Credentials
    cvelistv5