CVE-2023-46706 is a critical severity (CVSS 9.1) flaw in MachineSense FeverWarn devices, whose credentials cannot be changed by the user or administrator. CISA says no patch exists because MachineSense discontinued FeverWarn and its cloud service. Take the devices off your networks.
What's affected
The CISA advisory ICSA-24-025-01 lists FeverWarn ESP32, FeverWarn Raspberry Pi and FeverWarn DataHub Raspberry Pi as affected components. It does not map this CVE to individual models and gives no version numbers.
CISA says MachineSense discontinued FeverWarn and its cloud service before the end of the pandemic, that there will be no further upgrades, and that the vendor knows of no current users. CISA also says it had no reports of public exploitation. The weakness is CWE-798. The vector shows a network attack with no privileges, high confidentiality and integrity impact.
The NVD record scores it 9.1 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. The weakness class is CWE-798 (hard-coded credentials). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Look for FeverWarn devices in your asset records, building systems and any lab or workplace health monitoring setup. Search your network for hosts that identify as FeverWarn or MachineSense, using your network inventory tool.
There is no version to check, since no fix exists. Presence is what matters.
What to do now
- Search your inventory and network scans for FeverWarn and MachineSense devices.
- Disconnect any you find and retire them, as no fix will arrive.
- If removal is not possible at once, isolate them behind a firewall with no internet access.
- Follow the CISA guidance on limiting exposure and using current VPNs for remote access.
- Record retirement in your asset register.
Why it matters
Hard-coded credentials mean everyone who owns the device shares the same key, and the owner cannot change it. Once the credentials are known, the device is open to anyone who can reach it on the network.
With the product discontinued, there is nobody to ship a patch. The right response is retirement, and the lesson for buyers is to ask vendors about credential management before deploying connected devices.
Quick check
Will there be a patch?
No. CISA says the product is discontinued.
Is it exploited?
CISA reports no known public exploitation, and the record is not in KEV.
Sources
Last reviewed: 19 October 2026.
