CVE-2026-35503

SenseLive X3050 Use of Hard-coded Credentials

Published Apr 23, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Description

A vulnerability in SenseLive X3050’s web management interface allows authentication logic to be performed entirely on the client side, relying on hardcoded values within browser-executed scripts rather than server-side verification. An attacker with access to the login page could retrieve these exposed parameters and gain unauthorized access to administrative functionality.

Analysis

Technical impact

The defect causes the web management interface to perform authentication entirely on the client side, using hard‑coded credentials embedded in browser scripts. An attacker who can reach the login page can discover these values and gain administrative access without needing a valid server‑side account. This enables full control of the device, compromising confidentiality, integrity, and availability of the system.

Affected Systems

SenseLive X3050

Risk and Exploitability

The CVSS score of 9.3 indicates a critical severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the present time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation is straightforward for anyone able to open the web interface; no special privileges or exploits are required beyond basic network access. Attackers use the exposed login page to extract hard‑coded credentials and authenticate as an administrator.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

SenseLive

X3050

unaffected

Version	Status	Constraints
`V1.523`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:senselive:x3500_firmware:1.523:*:*:*:*:*:*:*

cpe:2.3:h:senselive:x3500:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Senselive

X3050

Version	Status	Scheme	Platform
`V1.523`	affected	generic	—

Remediation

Vendor Solution

SenseLive did not respond to CISA's requests to coordinate. Affected users are encouraged to reach out to SenseLive for more information. https://senselive.io/contact

OpenCVE Recommended Actions

Contact SenseLive for remediation guidance or an updated firmware image
Restrict access to the web management interface to trusted IP ranges or a VPN tunnel
Enable logging and regularly review authentication events for suspicious activity

Generated by OpenCVE AI on April 28, 2026 at 14:34 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.548% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-12.json
https://senselive.io/contact
https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12

History

Apr 28, 2026 7:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Senselive x3500 Senselive x3500 Firmware
CPEs		cpe:2.3:h:senselive:x3500:-:::::::* cpe:2.3:o:senselive:x3500_firmware:1.523:::::::*
Vendors & Products		Senselive x3500 Senselive x3500 Firmware

Apr 28, 2026 9:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Senselive Senselive x3050
Vendors & Products		Senselive Senselive x3050

Apr 24, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 24, 2026 12:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability in SenseLive X3050’s web management interface allows authentication logic to be performed entirely on the client side, relying on hardcoded values within browser-executed scripts rather than server-side verification. An attacker with access to the login page could retrieve these exposed parameters and gain unauthorized access to administrative functionality.
Title		SenseLive X3050 Use of Hard-coded Credentials
Weaknesses		CWE-798
References		https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-12.json https://senselive.io/contact https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`