A SenseLive X3050 remote management service suffers from a missing authentication flaw that permits any host on the network to retrieve or upload firmware images. The service does not verify user privileges, check the integrity of the uploaded images, or confirm the authenticity of the firmware. If an attacker substitutes legitimate firmware with a malicious image, they can gain complete control of the device, compromising confidentiality, integrity, and availability of the entire system.

All SenseLive X3050 devices that use the default remote management interface are potentially affected. The advisory does not list specific firmware versions, so any deployment using the remote management service is considered vulnerable.

The advisory assigns a CVSS score of 9.3, indicating a high severity vulnerability. The EPSS score is reported as less than 1%, reflecting a low but non‑zero current exploitation probability, and the issue is not listed in CISA’s KEV catalog. Attackers can exploit the flaw from any host that can reach the remote management endpoint, making the attack vector network‑based. Because no vendor patch is publicly available, the risk remains high until a remediation or configuration countermeasure is applied.