CVE-2026-25775
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval and update operations to be performed without authentication or authorization. The service accepts firmware-related requests from any reachable host and does not verify user privileges or the integrity of uploaded images.
Risk Assessment
The lack of authorization in firmware update operations poses a risk of unauthorized access to the system, potentially leading to the introduction of malicious software or data loss.
Recommendation
It is recommended to implement authentication and authorization mechanisms for the remote management service and to monitor and restrict access to this service only to trusted hosts.
Other vulnerabilities in SenseLive X3050
See all- CVE-2026-40431Medium
The SenseLive X3050 web management interface relies on unencrypted HTTP for all administrative communication. Authentication attempts and configuration data are transmitted in cleartext, allowing an attacker on the same network segment to intercept sensitive operational information.
- CVE-2026-25720Medium
The SenseLive X3050 web management interface does not properly enforce session lifetime, allowing authenticated sessions to remain active for extended periods without re-authentication. An attacker with access to a previously authenticated session can continue using administrative functions.
Original NVD description (English source)
A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval and update operations to be performed without authentication or authorization. The service accepts firmware-related requests from any reachable host and does not verify user privileges, integrity of uploaded images, or the authenticity of provided firmware.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS