CVE-2026-40620

SenseLive X3050 Missing authentication for critical function

Published Apr 24, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Description

A vulnerability in SenseLive X3050’s embedded management service allows full administrative control to be established without any form of authentication or authorization on the SenseLive config application. The service accepts management connections from any reachable host, enabling unrestricted modification of critical configuration parameters, operational modes, and device state through a vendor-supplied or compatible client.

Analysis

Technical impact

A flaw in the embedded management service of SenseLive X3050 permits any host that can reach the device to connect to the config application without needing authentication or authorization. The vulnerability allows unrestricted changes to critical configuration parameters, operational modes, and device state. The secured administrative interface is effectively bypassed, giving an attacker full control over the impacted device.

Affected Systems

The vulnerability affects the SenseLive X3050 series. No specific firmware or version ranges are recorded in the data, so all deployed units of this model are potentially impacted.

Risk and Exploitability

With a CVSS score of 9.3 the flaw is considered critical. The EPSS score is below 1 %, indicating a low probability of exploitation at the time of analysis, and the issue is not currently listed in CISA’s KEV catalog. Nevertheless, the likely attack vector is local network exposed with no authentication to the management service, allowing an attacker who can reach the device to immediately take administrative control. The weakness is categorized as CWE‑306 (Missing Authentication).

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

SenseLive

X3050

unaffected

Version	Status	Constraints
`V1.523`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:senselive:x3500_firmware:1.523:*:*:*:*:*:*:*

cpe:2.3:h:senselive:x3500:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Senselive

X3050

Version	Status	Scheme	Platform
`V1.523`	affected	generic	—

Remediation

Vendor Solution

SenseLive did not respond to CISA's requests to coordinate. Affected users are encouraged to reach out to SenseLive for more information. https://senselive.io/contact

OpenCVE Recommended Actions

Contact SenseLive support through their contact page (https://senselive.io/contact) to request an official firmware update or workaround for the authentication issue.
Restrict access to the embedded management service by configuring firewall rules or network segmentation to allow only trusted hosts or IP ranges, thereby preventing unauthorized management connections.
Implement monitoring or intrusion detection to alert on unexpected management protocol traffic, and review logs for signs of unauthorized configuration attempts.

Generated by OpenCVE AI on April 28, 2026 at 23:49 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.546% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-12.json
https://senselive.io/contact
https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12

History

Apr 28, 2026 7:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Senselive x3500 Senselive x3500 Firmware
CPEs		cpe:2.3:h:senselive:x3500:-:::::::* cpe:2.3:o:senselive:x3500_firmware:1.523:::::::*
Vendors & Products		Senselive x3500 Senselive x3500 Firmware

Apr 28, 2026 9:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Senselive Senselive x3050
Vendors & Products		Senselive Senselive x3050

Apr 24, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 24, 2026 12:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability in SenseLive X3050’s embedded management service allows full administrative control to be established without any form of authentication or authorization on the SenseLive config application. The service accepts management connections from any reachable host, enabling unrestricted modification of critical configuration parameters, operational modes, and device state through a vendor-supplied or compatible client.
Title		SenseLive X3050 Missing authentication for critical function
Weaknesses		CWE-306
References		https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-12.json https://senselive.io/contact https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`