CVE-2023-47867 is a high severity (CVSS 8.8) access control flaw in MachineSense FeverWarn devices. They are set up as Wi-Fi hosts, so an attacker within wireless range can reach the device's web services. There is no patch to install: CISA reports the product is discontinued and gets no upgrades, so retire or isolate any unit you still run.
What's affected
The record names the MachineSense FeverWarn hardware and its firmware, with no version limit. The NVD description is short: FeverWarn devices are configured as Wi-Fi hosts in a way that lets attackers within range connect to the device's web services and compromise the device.
The record scores it 8.8 (High) with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms: the attacker must be on the same adjacent network (here, in Wi-Fi range), needs no account and no user action, and could affect confidentiality, integrity and availability. The weakness class is CWE-284 (Improper Access Control).
CISA advisory ICSA-24-025-01 lists the affected components of the FeverWarn system as the ESP32 unit, the Raspberry Pi unit and the DataHub Raspberry Pi. It covers several other CVEs for the same product family, so one device can carry more than one of them. CISA's own score for this CVE is also 8.8, which matches the record.
The advisory was published on 25 January 2024. The record does not flag this CVE as exploited in the wild, and the CISA advisory does not say it is being exploited.
How to check if you're exposed
There is no package to query, so exposure is a question of whether the devices exist on your premises. FeverWarn was an IoT skin temperature scanning system sold during the pandemic, so look in places that used it for health screening, such as entrances, lobbies and clinics.
- Walk your asset register for any entry named MachineSense or FeverWarn.
- Scan your wireless environment for access points that you did not set up. A FeverWarn unit acts as a Wi-Fi host itself, so it can appear as an unexpected network name near the place it was installed.
- Ask facilities and security teams whether any temperature screening kit was bought and left in storage or still powered on.
CISA says MachineSense is not aware of any current use of FeverWarn. That is a vendor statement, not proof for your site, so confirm it on your own premises.
What to do now
- Find every FeverWarn unit and power it off if it is not needed. The vendor says no updates will ever ship.
- Remove the hardware from the network and the building if the screening function is no longer in use, and update the asset register.
- If a unit must stay in service, follow the CISA advice: keep it off the internet, put it behind a firewall and isolate it from business networks.
- Contact MachineSense for further information, as the advisory suggests, and record the answer in your risk register.
- Check the other CVEs in advisory ICSA-24-025-01, since they apply to the same device family.
Why it matters
The flaw is an access control mistake in how the device presents itself on the air. A device that hosts its own Wi-Fi network and exposes its web services to anyone who can join it gives a nearby person a direct path to the device. The CWE-284 (Improper Access Control) label covers this kind of gap, where the system fails to limit who can reach a function.
Discontinued products are the hard case for supply chain work. There is no patch to track, so the only controls are removal and isolation. Keeping a current inventory of connected devices, including old ones in a cupboard, is what makes that decision possible. You can read the Safeguard Gold page for this CVE for the record details and use the free in-browser dependency scan at gold.safeguard.sh/scan for the software side of your estate.
Quick check
Is there a fix for CVE-2023-47867?
CISA reports that FeverWarn and its cloud service were discontinued and will get no upgrades, so no patch is expected. Retire the device or isolate it, and contact MachineSense for more information.
Is this CVE exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability, and the CISA advisory does not say it is being exploited.
Sources
Last reviewed: 19 October 2026.
