SenseLive X3050 version V1.523 contains a CWE-798 vulnerability where authentication logic is performed entirely on the client side. Hardcoded credential values embedded in client-side scripts can be retrieved by an attacker with access to the login page, bypassing server-side verification and enabling unauthorized administrative access. This vulnerability has a CVSS 4.0 score of 9.3 (critical) with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor as of the data provided.

An attacker can gain unauthorized administrative access to the SenseLive X3050 device by extracting hardcoded credentials from client-side scripts. This compromises the confidentiality, integrity, and availability of the device’s management interface, potentially allowing full control over the device. The vulnerability does not require any privileges or user interaction to exploit and can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device’s management interface to trusted networks and users only to reduce exposure. Monitor for any updates from SenseLive regarding patches or mitigations.