CVE-2023-49617 is a critical severity (CVSS 10.0) missing authentication flaw in the MachineSense application programming interface used by FeverWarn devices. A remote attacker can read and change sensitive data without logging in. CISA says there will be no fix, so take the devices off any reachable network.
What's affected
The record covers the MachineSense API and the FeverWarn firmware and hardware. The weakness is CWE-306 (missing authentication for a critical function). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N: reachable over the network, no privileges, no user action, and a changed scope.
CISA advisory ICSA-24-025-01 lists the affected FeverWarn components in general terms, naming ESP32, Raspberry Pi and DataHub Raspberry Pi parts, with no version numbers. Fixed versions: none. The advisory states the products are no longer available and will not be upgraded.
The record and CISA agree on the 10.0 score.
How to check if you're exposed
Confirm whether you operate any FeverWarn or MachineSense devices and whether their API is reachable from outside a trusted segment.
From a machine on an authorized network, you can test whether an internal address answers API requests without credentials. Only test hardware you own. If the API answers without a login, treat the data it holds as exposed. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Inventory all MachineSense and FeverWarn devices and where they connect.
- Block internet and user network access to them at the firewall. Allow only the few hosts that must talk to them.
- Keep any remote access behind an updated VPN, as CISA advises.
- Assume data stored on or reachable through the API may have been read or altered, and review it for tampering.
- Replace the devices with a supported product and retire these.
Why it matters
An API that needs no authentication treats every caller as trusted. Anyone who can reach it can retrieve data and modify it, which is why the score reaches the maximum.
Missing authentication is a design gap, not a coding slip, so no input filter fixes it. With the vendor out of business for this line, the only durable answer is removal from reachable networks. This CVE is not on the CISA KEV list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a patch available?
No. CISA's advisory says the products are discontinued and no upgrades will be issued.
Why is the score 10.0?
The attack is remote, needs no privileges or interaction, changes scope, and gives high confidentiality and integrity impact.
Sources
Last reviewed: 19 October 2026.
