CVE-2026-25720
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The SenseLive X3050 web management interface does not properly enforce session lifetime, allowing authenticated sessions to remain active for extended periods without re-authentication. An attacker with access to a previously authenticated session can continue using administrative functions.
Risk Assessment
A hijacked or abandoned administrative session can be used for unauthorized device management over an extended period.
Recommendation
Implement session expiration and re-authentication after inactivity; consider updating the device firmware.
Other vulnerabilities in SenseLive X3050
See all- CVE-2026-25775Critical
A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval and update operations to be performed without authentication or authorization. The service accepts firmware-related requests from any reachable host and does not verify user privileges or the integrity of uploaded images.
- CVE-2026-40431Medium
The SenseLive X3050 web management interface relies on unencrypted HTTP for all administrative communication. Authentication attempts and configuration data are transmitted in cleartext, allowing an attacker on the same network segment to intercept sensitive operational information.
Original NVD description (English source)
A vulnerability exists in SenseLive X3050’s web management interface due to improper session lifetime enforcement, allowing authenticated sessions to remain active for extended periods without requiring re-authentication. An attacker with access to a previously authenticated session could continue interacting with administrative functions long after legitimate user activity has ceased.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS