What’s Vulnerable › Vulnerabilities

CVE-2026-27843: SenseLive X3050 Missing authentication for critical function

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-24 · updated 2026-10-26
• Weakness: CWE-306

Description

A vulnerability exists in SenseLive X3050's web management interface that allows critical configuration parameters to be modified without sufficient authentication or server-side validation. By applying unsupported or disruptive values to recovery mechanisms and network settings, an attacker can induce a persistent lockout state. Because the device lacks a physical reset button, recovery requires specialized technical access via the console to perform a factory reset, resulting in a total denial-of-service for the gateway and its connected RS-485 downstream systems.

Affected products

• SenseLive X3500 Firmware: 1.523

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-12.json
• https://senselive.io/contact
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12

Get alerted when CVE-2026-27843 or the next vulnerability affects your stack