CVE-2026-40620

CriticalCVSS 9.8/10Last modified Oct 25, 2026

Description

A vulnerability in SenseLive X3050’s embedded management service allows full administrative control to be established without any form of authentication or authorization on the SenseLive config application. The service accepts management connections from any reachable host, enabling unrestricted modification of critical configuration parameters, operational modes, and device state through a vendor-supplied or compatible client.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
SenseLive	X3050	V1.523

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-12.jsonThird Party Advisory
https://senselive.io/contactProduct
https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12US Government Resource

Timeline

Published: Apr 24, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-406219.3ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated wi CVE-2026-406227.5NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that could ex CVE-2026-406238.1A vulnerability in SenseLive X3050's web management interface allows critical system and network configuration parameters to be modified wit CVE-2026-406249.8Improper input validation in AVer PTC500S, PTC115, PTC500+, and PTC115+ cameras may allow a remote, unauthenticated attacker to achieve ar CVE-2026-406265.4Uncontrolled search path for some Intel(R) Wireless Bluetooth(R) software for Windows within Ring 3: User Applications may allow an escalati CVE-2026-406279.1An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B202 CVE-2026-406297.5When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connect CVE-2026-40634.3The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability c CVE-2026-406309.8A vulnerability in SenseLive X3050’s web management interface allows unauthorized access to certain configuration endpoints due to improp CVE-2026-406318.7An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resul CVE-2026-406335.5Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, versions 9.11.0.0 through 9.13.0.2 contains an Insertion of Sensitive Information i CVE-2026-406355.4Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. A low privileged remote attacker