Skip to main content

SenseLive X3050 CVE-2026-40630

| EUVDEUVD-2026-25350 CRITICAL
Authentication Bypass Using an Alternate Path or Channel (CWE-288)
2026-04-24 ics-cert@hq.dhs.gov GHSA-qf4m-p7c4-p4m7
9.3
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
Re-analysis Queued
Apr 24, 2026 - 14:52 vuln.today
cvss_changed
Analysis Generated
Apr 24, 2026 - 00:46 vuln.today
EUVD ID Assigned
Apr 24, 2026 - 00:22 euvd
EUVD-2026-25350
Analysis Generated
Apr 24, 2026 - 00:22 vuln.today
CVE Published
Apr 24, 2026 - 00:16 nvd
CRITICAL 9.3

DescriptionCVE.org

A vulnerability in SenseLive

X3050’s web management interface allows unauthorized access to certain configuration endpoints due to improper access control enforcement. An attacker with network access to the device may be able to bypass the intended authentication mechanism and directly interact with sensitive configuration functions.

AnalysisAI

Remote unauthenticated attackers can bypass authentication and access sensitive configuration endpoints in SenseLive X3050's web management interface. The vulnerability enables complete device compromise without credentials due to improper access control enforcement (CWE-288). Reported by ICS-CERT and published in CISA advisory ICSA-26-111-12, this affects operational technology environments where the X3050 is deployed. With CVSS 9.3 (Critical) and network attack vector requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), this presents immediate risk to internet-exposed or network-accessible devices.

Technical ContextAI

SenseLive X3050 is an industrial IoT/OT device with a web-based management interface. The vulnerability stems from CWE-288 (Authentication Bypass Using an Alternate Path or Channel), where the application fails to properly enforce access controls on certain configuration endpoints. The CVSS 4.0 vector indicates the flaw allows network-based exploitation with low complexity, no required privileges, and no user interaction. The vulnerable component is the device's HTTP/HTTPS management interface, which should require authentication before exposing configuration functions. Instead, attackers can directly interact with sensitive endpoints by crafting requests that circumvent the intended authentication flow. This represents a complete failure of the authentication boundary for specific administrative functions, typical of path traversal, direct object reference, or missing authorization checks on API endpoints.

RemediationAI

Consult CISA advisory ICSA-26-111-12 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12 for vendor-specific remediation guidance and patched firmware version if available. Contact SenseLive directly via https://senselive.io/contact to request security updates and affected version confirmation. Until patched firmware is deployed, implement immediate network-level compensating controls: isolate X3050 devices on dedicated OT network segments with no direct internet exposure, restrict management interface access to specific jump hosts or management VLANs using firewall ACLs limiting source IPs to authorized administrators only, and disable the web management interface entirely if command-line or out-of-band management alternatives exist (verify with vendor whether this breaks required functionality). Deploy intrusion detection signatures monitoring for unauthorized HTTP/HTTPS requests to X3050 management IPs from non-administrative sources. Consider placing devices behind reverse proxy with enforced authentication as temporary mitigation, though this adds architectural complexity and potential availability risk if proxy fails. Review X3050 access logs for evidence of unauthorized configuration changes prior to implementing controls.

Share

CVE-2026-40630 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy