title: MachineSense FeverWarn Missing Authentication for Critical Function
description:
The MachineSense application programmable interface (API) is improperly protected and can be accessed without authentication. A remote attacker could retrieve and modify sensitive information without any authentication.
problem types: CWE-306 Missing Authentication for Critical Function
affected:
{
defaultStatus: unaffected
product: FeverWarn
vendor: MachineSense
versions:
status: affected, version: ESP32
status: affected, version: RaspberryPi
status: affected, version: DataHub RaspberryPi
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
workarounds:
FeverWarn and the associated cloud service were pandemic-specific products for elevated body temperature scanning, discontinued by MachineSense prior to the end of the pandemic. They are no longer available, and there will be no future availability or upgrades. MachineSense is not aware of any current users of FeverWarn. Users of the affected product are encouraged to  contact MachineSense https://machinesense.com/pages/about-machinesense  for additional information.