PT-2024-1430 · Machinesense · Feverwarn Esp32+2

Vera Mens

·

Published

2024-01-25

·

Updated

2024-08-02

·

CVE-2023-49610

CVSS v3.1

8.1

High

VectorAV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Name of the Vulnerable Software and Affected Versions MachineSense FeverWarn Raspberry Pi-based devices (affected versions not specified) FeverWarn ESP32 (affected versions not specified) FeverWarn DataHub RaspberryPi (affected versions not specified)
Description The issue is related to insufficient input sanitization, which could allow an attacker on an adjacent network to send a message that runs commands or overflows the stack, potentially enabling the execution of arbitrary commands or causing a denial of service.
Recommendations For MachineSense FeverWarn Raspberry Pi-based devices, restrict access to adjacent networks to minimize the risk of exploitation until a patch is available. For FeverWarn ESP32, consider implementing additional input validation mechanisms to prevent command execution. For FeverWarn DataHub RaspberryPi, avoid using potentially vulnerable communication protocols until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-00905
CVE-2023-49610

Affected Products

Feverwarn Datahub Raspberrypi
Feverwarn Esp32
Machinesense Feverwarn Raspberry Pi-Based Devices