The vulnerability lies in SenseLive X3050’s web management interface, which exclusively uses unencrypted HTTP for all administrative communication. As a result, the interface transmits authentication credentials, configuration data, and other sensitive operational information in cleartext. An attacker who can observe traffic on the same network segment could intercept and decode this information, leading to confidential process data exposure and potential credential compromise, thereby violating confidentiality.

The affected product is SenseLive X3050. No specific firmware or software version is identified beyond the product model itself, indicating that all deployments of this model are susceptible until a remediation is applied.

The CVSS score of 6.9 positions the issue in the moderate severity range. The EPSS score of less than 1 percent suggests that exploitation occurrence is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. The attack requires network access to the management interface, implying that an attacker must already be on or able to observe the same local network segment. Because the data is transmitted without encryption, interception is straightforward for an attacker in this position. The risk is thus moderate, with potential for significant confidential data leakage if an adversary gains local network access.