Threats affecting pkg:github/senselive/X3050

CVE-2026-27841 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting the SenseLive X3050 web management interface. The vulnerability arises because the application does not implement server-side validation of request origin nor CSRF tokens, allowing unauthorized state-changing operations to be triggered via a malicious external webpage. This could enable an attacker to cause a user's browser to submit unauthorized configuration requests to the device without user interaction. There is no official patch or remediation level currently provided by the vendor. No known exploits are reported in the wild at this time.

CVE-2026-40623 is a high-severity vulnerability in the SenseLive X3050 web management interface that allows modification of critical system and network configuration parameters without sufficient authorization or validation. This includes parameters such as IP addressing, watchdog timers, reconnect intervals, and service ports. The lack of proper enforcement of constraints and safeguards can lead to destabilization of device operation or persistent unavailability. The vulnerability affects version V1.523 of the product. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-40431 is a medium severity vulnerability in the SenseLive X3050 device's web management interface. The interface uses unencrypted HTTP for all administrative communications, causing sensitive information such as authentication credentials and configuration data to be transmitted in cleartext. This allows an attacker on the same network segment to intercept or observe this sensitive data. There is no official patch or remediation level currently provided by the vendor. The vulnerability has not been reported as exploited in the wild.

CVE-2026-39462 is a critical vulnerability in the SenseLive X3050 device's web management interface where password updates are not reliably applied. After a factory reset using the SenseLive Config 2.0 tool, the interface may falsely indicate a successful password change, but the system may continue to accept previous or default credentials. This indicates that the password-change process is not consistently enforced, potentially allowing unauthorized access even after a reset.

CVE-2026-35503 is a critical vulnerability in the SenseLive X3050 web management interface where authentication is improperly handled on the client side using hardcoded credentials in browser-executed scripts. This design flaw allows an attacker who can access the login page to extract these credentials and gain unauthorized administrative access. The vulnerability affects version V1.523 of the product and has a high CVSS score of 9.3, indicating severe impact. No official patch or remediation guidance is currently available from the vendor. Exploits are not known to be in the wild at this time.

CVE-2026-25720 is a medium severity vulnerability in the SenseLive X3050 web management interface caused by insufficient session expiration. Authenticated sessions remain active for extended periods without requiring re-authentication, allowing an attacker with access to a previously authenticated session to continue administrative interactions after legitimate user activity has ended. There is no confirmed patch or official remediation available at this time.

CVE-2026-40630 is a critical authentication bypass vulnerability in the SenseLive X3050 web management interface. It allows an attacker with network access to bypass authentication and access sensitive configuration endpoints due to improper access control enforcement. The vulnerability affects version V1.523 of the product. There is no official patch or remediation level currently provided by the vendor. No known exploits are reported in the wild at this time.