CVE-2023-6221

The cloud provider MachineSense uses for integration and deployment for multiple MachineSense devices, such as the programmable logic controller (PLC), PumpSense, PowerAnalyzer, FeverWarn, and others is insufficiently protected against unauthorized access. An attacker with access to the internal procedures could view source code, secret credentials, and more.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://machinesense.com/pages/about-machinesense	Product
https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:machinesense:feverwarn_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:machinesense:feverwarn:-:*:*:*:*:*:*:*

History

08 Feb 2024, 16:01

Type	Values Removed	Values Added
First Time		Machinesense Machinesense feverwarn Firmware Machinesense feverwarn
CVSS	v2 : ~~unknown~~ v3 : ~~7.7~~	v2 : unknown v3 : 6.5
Summary		(es) El proveedor de nube que MachineSense utiliza para la integración y la implementación de múltiples dispositivos MachineSense, como el controlador lógico programable (PLC), PumpSense, PowerAnalyzer, FeverWarn y otros, no está suficientemente protegido contra el acceso no autorizado. Un atacante con acceso a los procedimientos internos podría ver el código fuente, credenciales secretas y más.
References	~~() https://machinesense.com/pages/about-machinesense -~~	() https://machinesense.com/pages/about-machinesense - Product
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01 -~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01 - Third Party Advisory, US Government Resource
CPE		cpe:2.3:o:machinesense:feverwarn_firmware:-:::::::* cpe:2.3:h:machinesense:feverwarn:-:::::::*

01 Feb 2024, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-02-01 23:15

Updated : 2024-04-11 01:23

NVD link : CVE-2023-6221

Mitre link : CVE-2023-6221

CVE.ORG link : CVE-2023-6221

JSON object : View

Products Affected

machinesense

feverwarn
feverwarn_firmware

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2023-6221", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "published": "2024-02-01T23:15:10.510", "references": [{"url": "https://machinesense.com/pages/about-machinesense", "tags": ["Product"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-306"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "\nThe cloud provider MachineSense uses for integration and deployment for multiple MachineSense devices, such as the programmable logic controller (PLC), PumpSense, PowerAnalyzer, FeverWarn, and others is insufficiently protected against unauthorized access. An attacker with access to the internal procedures could view source code, secret credentials, and more.\n\n"}, {"lang": "es", "value": "El proveedor de nube que MachineSense utiliza para la integraci\u00f3n y la implementaci\u00f3n de m\u00faltiples dispositivos MachineSense, como el controlador l\u00f3gico programable (PLC), PumpSense, PowerAnalyzer, FeverWarn y otros, no est\u00e1 suficientemente protegido contra el acceso no autorizado. Un atacante con acceso a los procedimientos internos podr\u00eda ver el c\u00f3digo fuente, credenciales secretas y m\u00e1s."}], "lastModified": "2024-04-11T01:23:15.053", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:machinesense:feverwarn_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45F21168-E7F1-49E4-84B0-0B4EB9C6DE50"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:machinesense:feverwarn:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "489AD7C3-7648-4398-BA27-450E909171EC"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}