by Kastro
Paper/Archive/CVE-2026-25775

CVE-2026-25775

SenseLive X3050 — SenseLive X3050 Missing authentication for critical function

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 34.8.348 × 207.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval and update operations to be performed without authentication or authorization. The service accepts firmware-related requests from any reachable host and does not verify user privileges, integrity of uploaded images, or the authenticity of provided firmware.

Affected

ProductAffectedFixed inSource
X3050V1.523–CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsenselive.io/contactrefcisa.gov/news-events/ics-advisories/icsa-26-111-12refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-12.json