Authentication Bypass Vulnerability in SenseLive X3050 Remote Management Service
CVE-2026-25775

9.3CRITICAL

Key Information:

Vendor

Senselive

Status
X3050
Vendor
CVE Published:
24 April 2026

What is CVE-2026-25775?

A significant vulnerability exists in the remote management services of the SenseLive X3050, where unauthorized users can initiate firmware retrieval and updates without proper authentication or authorization checks. This flaw exposes the service to requests from any reachable host, enabling potential threats as the system fails to verify user privileges and the integrity of firmware images. The lack of adequate security controls could lead to unauthorized firmware modifications, ultimately compromising the device's functionality and security.

Affected Version(s)

X3050 V1.523

References

https://senselive.io/contact
https://www.cisa.gov/news-events/ics-advisories/icsa-26-1...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jithin Nambiar J reported these vulnerabilities to CISA.
.