by Kastro
Paper/Archive/CVE-2026-40620

CVE-2026-40620

SenseLive X3050 — SenseLive X3050 Missing authentication for critical function

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 45.8.458 × 209.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability in SenseLive X3050’s embedded management service allows full administrative control to be established without any form of authentication or authorization on the SenseLive config application. The service accepts management connections from any reachable host, enabling unrestricted modification of critical configuration parameters, operational modes, and device state through a vendor-supplied or compatible client.

Affected

ProductAffectedFixed inSource
X3050V1.523–CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsenselive.io/contactrefcisa.gov/news-events/ics-advisories/icsa-26-111-12refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-12.json