CVE-2023-49115 is a high severity (CVSS 7.5) missing authentication flaw in MachineSense FeverWarn, an IoT skin temperature scanning system. Its MQTT messaging has no authentication. CISA reports the product was discontinued with no future upgrades, so there is no patch and any remaining devices should be removed.
What's affected
- MachineSense FeverWarn, covering the ESP32, RaspberryPi and DataHub RaspberryPi components listed in CISA advisory ICSA-24-025-01.
- Fix: none. CISA says MachineSense discontinued FeverWarn and its cloud service before the end of the pandemic, that they are no longer available, and that there will be no future availability or upgrades.
- CISA also says MachineSense is not aware of any current users of FeverWarn, and encourages users to contact MachineSense.
- Scoring note: the record's 7.5 matches the CISA entry for this CVE. The 10.0 headline on the CISA page belongs to a different CVE in the same advisory, CVE-2023-49617, so do not read it as this CVE's score.
- Severity: the record gives CVSS 7.5, which is high. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Read plainly, it describes an attack over the network, with low attack complexity, requiring no privileges and no user interaction. Impact on confidentiality is high, on integrity none and on availability none. The scope is unchanged, so the impact stays within the vulnerable component.
How to check if you're exposed
This is a question of finding devices, not versions. Look for FeverWarn units, which were used for elevated body temperature scanning, on your network and in storage. Check asset records, and ask facilities and health and safety teams, since the product was sold for pandemic screening.
On the network, look for MQTT traffic, which normally uses TCP port 1883 or 8883, from unfamiliar IoT hosts. A device that publishes sensor data over MQTT without credentials is the pattern this CVE describes.
If you find none, record that result so the check does not need repeating.
What to do now
- Locate every FeverWarn unit and its DataHub, and take them off the network.
- Decommission the devices, since no fix will be released.
- Block outbound traffic from these devices and any traffic to their MQTT service while you work.
- Follow CISA's guidance: keep control system devices off the internet, behind firewalls and isolated from business networks.
- Add a check for discontinued IoT products to your inventory review.
Why it matters
The class is CWE-306 (Missing Authentication for Critical Function). MQTT is a lightweight messaging protocol common in IoT. Used without authentication, anyone who can reach the broker can read the messages, which here include sensor data that users view remotely. The vector shows high confidentiality impact only.
The larger lesson is end of life hardware. There is no patch to apply. The only controls are removing the device or isolating it. Products tied to a cloud service can fail in a second way, because when the vendor shuts the service down, the devices keep running with nobody maintaining them.
Quick check
Is there a patch?
No. CISA says the product and its cloud service are discontinued, with no future availability or upgrades.
Why does the CISA page show a score of 10.0?
That score belongs to a different CVE in the advisory. For CVE-2023-49115, CISA's score is 7.5, matching the record.
Sources
Last reviewed: 19 October 2026.
