CVE-2026-40431
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The SenseLive X3050 web management interface relies on unencrypted HTTP for all administrative communication. Authentication attempts and configuration data are transmitted in cleartext, allowing an attacker on the same network segment to intercept sensitive operational information.
Risk Assessment
An attacker with access to the same network segment could capture administrator credentials and configuration data, potentially leading to device compromise.
Recommendation
Enforce encrypted administrative communication (HTTPS) and restrict management interface access to trusted network segments only.
Other vulnerabilities in SenseLive X3050
See all- CVE-2026-25775Critical
A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval and update operations to be performed without authentication or authorization. The service accepts firmware-related requests from any reachable host and does not verify user privileges or the integrity of uploaded images.
- CVE-2026-25720Medium
The SenseLive X3050 web management interface does not properly enforce session lifetime, allowing authenticated sessions to remain active for extended periods without re-authentication. An attacker with access to a previously authenticated session can continue using administrative functions.
Original NVD description (English source)
A vulnerability exists in SenseLive X3050’s web management interface due to its reliance on unencrypted HTTP for all administrative communication. Because management traffic, including authentication attempts and configuration data, is transmitted in cleartext, an attacker with access to the same network segment could intercept or observe sensitive operational information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS