CVE-2023-46706 and ICSA-24-025-01 MachineSense FeverWarn system Vulnerabilities

CVE-2023-46706 and ICSA-24-025-01 are related to vulnerabilities in the MachineSense FeverWarn system. This system, used during the pandemic for elevated body temperature scanning, is an IoT-based skin temperature scanning system.

CVE-2023-46706 specifically refers to the use of hard-coded credentials in multiple MachineSense devices, which makes it impossible for users or administrators to change these credentials. This vulnerability has a CVSS v3 base score of 9.1, indicating a high level of severity.

The ICSA-24-025-01 advisory, released by CISA on January 25, 2024, covers a range of vulnerabilities in the FeverWarn ecosystem, affecting components like FeverWarn ESP32, RaspberryPi, and DataHub RaspberryPi. These vulnerabilities include missing authentication for critical functions, improper access control, and improper input validation, among others. The risks associated with these vulnerabilities are significant, as successful exploitation could allow attackers to obtain user data, execute remote code, or gain control over devices for malicious purposes.

MachineSense discontinued the FeverWarn and its associated cloud service before the end of the pandemic, and there are no plans for future availability or upgrades. CISA recommends users of these products contact MachineSense for more information and advises taking defensive measures to minimize the risk of exploitation, such as minimizing network exposure and using secure methods like VPNs for remote access.

It’s important for organizations to conduct proper impact analysis and risk assessment before deploying defensive measures, and to report any suspected malicious activity to CISA for tracking and correlation with other incidents​

Check If You Are Affected

If you have used or are currently using MachineSense FeverWarn devices or any other related components within your organization, especially in the healthcare and public health sector in the United States, you may be affected by CVE-2023-46706 and the vulnerabilities outlined in ICSA-24-025-01. Here’s how to determine if you are affected and what steps to take if you are:

1. Check Your Inventory: Review your inventory of control systems and IoT devices to identify if any MachineSense FeverWarn systems or their components, such as FeverWarn ESP32, RaspberryPi, and DataHub RaspberryPi, are in use.

2. Review Vulnerability Details: Familiarize yourself with the specific vulnerabilities associated with these devices. The key vulnerabilities include missing authentication for critical functions, use of hard-coded credentials, improper access control, OS command injection, and improper input validation.

3. Check for Updates: Although MachineSense discontinued FeverWarn and its associated cloud service, it’s wise to contact MachineSense for any potential updates or guidance specific to these vulnerabilities.

Steps to Take if Affected

1. Isolate Affected Systems: If you identify any affected devices, minimize their network exposure. Ensure they are not accessible from the Internet and isolate them from your business networks.

2. Implement Firewalls and VPNs: Use firewalls to protect your control system networks and remote devices. When remote access is required, use secure methods like Virtual Private Networks (VPNs), ensuring they are updated to the most current version available.

3. Contact MachineSense: Reach out to MachineSense for guidance on how to proceed with the affected devices. Since the product line has been discontinued, they might provide specific recommendations for decommissioning or replacing these devices.

4. Perform Impact Analysis: Before implementing any defensive measures, conduct a thorough impact analysis and risk assessment to understand the implications for your specific environment.

5. Report Incidents: If you suspect any malicious activity related to these vulnerabilities, report your findings to CISA for tracking and correlation against other incidents.

6. Educate Your Team: Educate your staff about social engineering attacks. Encourage them to avoid clicking on unsolicited web links or opening attachments in email messages.

7. Stay Informed: Keep abreast of any new developments or updates related to these vulnerabilities from trusted cybersecurity sources.

By taking these steps, you can mitigate the risks associated with CVE-2023-46706 and ICSA-24-025-01, protecting your organization from potential cyber threats​