A flaw in the SenseLive X3050 web management interface permits alteration of critical configuration parameters without authentication or server‑side validation, exploiting an authentication bypass weakness (CWE‑306). This allows an attacker with web access to set unsupported recovery mechanisms and network values, which can lock the device. Because the device lacks a physical reset button, recovery requires console access and a factory reset, resulting in denial of service to the gateway and all downstream RS‑485 systems.

The vulnerability affects all SenseLive X3050 units; no specific firmware or hardware revisions are identified, so all current or prior deployments may be impacted.

With a CVSS score of 9.2, this is a critical vulnerability. The EPSS score of <1% reflects a low current exploitation probability, but the straightforward attack vector—remote web access without authentication—makes it highly exploitable in the right environment. The issue is not yet in the CISA KEV catalog. Exploitation would permanently deny service to the gateway and connected systems, potentially disrupting critical industrial processes.