A flaw in the SenseLive X3050’s web management interface permits state‑changing operations without Cross‑Site Request Forgery protections. Because the device lacks server‑side validation of request origin or CSRF tokens, an attacker could host a malicious webpage that causes a victim’s browser to submit unauthorized configuration requests to the device. This can lead to unintended configuration changes that may enable further compromise or disrupt device operation. The weakness is identified as CWE‑352: Cross‑Site Request Forgery.

The vulnerability affects SenseLive devices running the X3050 model. No specific firmware or build numbers are listed, so any deployed X3050 device that has not applied a vendor‑issued fix is potentially exposed.

The CVSS score of 8.4 indicates high severity, while the EPSS score of less than 1 % shows that exploits are not widely active yet. The vulnerability is not currently listed in the CISA KEV catalog. Likely exploitation requires the victim to visit a malicious site or receive a loaded link, after which the attacker can submit configuration changes through the victim’s browser. While the probability is low, the impact of a successful attack could be significant, allowing an attacker to alter device settings, disable security features, or prepare the device for additional attacks.