CVE-2023-49610 is a high severity (CVSS 8.1) input validation flaw in MachineSense FeverWarn Raspberry Pi based devices. An attacker on an adjacent network can send a message that runs commands or overflows the stack. CISA says the product is discontinued and no fix will come, so isolate or retire the units.
What's affected
The record lists the FeverWarn device and its firmware. The cause is missing input sanitization, classed as CWE-20 (improper input validation). The vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, which means the attacker must be on the same or an adjacent network, needs no account and needs no user action.
CISA advisory ICSA-24-025-01 covers this CVE together with CVE-2023-49617. It names the FeverWarn Raspberry Pi based devices but gives no version list. Fixed versions: none. The advisory says the products are no longer available and there will be no future upgrades.
Severity agrees across the record and the CISA advisory at 8.1.
How to check if you're exposed
Start with an asset inventory question: do you own any MachineSense FeverWarn units, including the ESP32 and Raspberry Pi parts that the advisory lists? Check facilities and temperature screening records, since these devices were sold for that use.
If you find one, check where it sits on the network. A device reachable from a guest, office or untrusted VLAN is the exposed case, because the attacker only needs adjacency. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Identify every FeverWarn unit and record its location and network segment.
- Move each unit to an isolated network segment with no route from user or guest networks, or unplug it.
- Follow CISA's general guidance: keep control system devices off the internet, place them behind firewalls and use updated VPNs for remote access.
- Plan to replace the devices. With no vendor fix, isolation reduces risk but does not remove it.
- Review logs from neighbouring systems for unexpected traffic to these devices.
Why it matters
The device accepts messages without checking their content. A message can then run commands or overflow a stack buffer, so a single missing validation step opens two routes to compromise.
The larger issue is lifecycle. When a vendor discontinues a product and a flaw is found afterwards, owners get no patch. Inventory and segmentation are the only controls left, which is why knowing what you own matters before the CVE arrives. This CVE is not on the CISA KEV list.
Quick check
Can I patch these devices?
No. CISA's advisory states the products are no longer available and there will be no upgrades.
What is the adjacent network requirement?
The attacker must reach the device from the same or a neighbouring network segment. Segmentation that blocks that path lowers the risk a great deal.
Sources
Last reviewed: 19 October 2026.
