SenseLive X3050 version V1.523 contains a CWE-306 vulnerability where the management ecosystem's discovery functions are accessible without authentication. This allows an attacker on the same network segment to enumerate devices by discovering their presence, identifiers, and management interfaces without needing credentials. The vulnerability is due to missing authentication controls on critical functions exposed by the underlying service. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality.

An attacker on the same network segment can perform unauthenticated discovery of SenseLive X3050 devices, potentially revealing sensitive information such as device presence, identifiers, and management interfaces. This information disclosure could facilitate further targeted attacks or reconnaissance. However, no direct exploitation or active attacks have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, network segmentation to limit access to the management protocol and monitoring for unauthorized scanning on the local network may reduce exposure. Avoid exposing the management interface to untrusted networks.