CVE Intelligence
Analysis AI-assisted

CVE-2026-27843: SenseLive X3050 Missing Authentication for Critical Function

CVE-2026-27843 affects the web management interface of the SenseLive X3050, where critical configuration parameters can be changed without sufficient authentication or server-side validation. The record describes a possible persistent lockout that, because there is no physical reset button, requires console-level recovery and can disrupt the gateway and its connected RS-485 downstream systems. The CNA scores it as critical, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-27843 is classified as CWE-306, Missing Authentication for Critical Function. According to the record, the web management interface of the SenseLive X3050 allows critical configuration parameters to be modified without sufficient authentication or server-side validation. The CNA is ICS-CERT, and the advisory is tracked as ICSA-26-111-12.

Impact

The record describes a persistent lockout state of the device. Because the device has no physical reset button, restoring it requires specialized technical access through the console to perform a factory reset. The record states this can cause a total denial of service for the gateway and its connected RS-485 downstream systems.

  • CVSS 3.1 base score: 9.1, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
  • CVSS 4.0 score reported by ICS-CERT: 9.2 (the full 4.0 vector is not present in the record).
  • SSVC fields in the record: technical impact total, automatable yes, exploitation none.

Affected products and versions

The record lists the following products:

  • SenseLive X3050, version V1.523.
  • Senselive X3500 Firmware, version 1.523.

No fixed version is listed in the record. The absence of a listed fix means the record does not identify one; it does not mean that no fix exists.

Exploitation status

The CISA KEV catalog entry is not listed for this CVE in the record, so no confirmed active exploitation is reported in the sources consulted. The EPSS probability in the record is 0.00806 (percentile 0.56385), which is a statistical estimate and not evidence of exploitation. The SSVC exploitation field is set to none.

Remediation and mitigation

The record does not provide a vendor fix or patch. Operators should take the following defensive steps while they confirm remediation status with the vendor:

  • Contact SenseLive through the vendor contact page referenced in the record to ask about firmware updates and the status of this issue.
  • Restrict access to the management interface so that it is reachable only from trusted administrative networks and never from untrusted or internet-facing segments.
  • Place the gateway behind segmented network zones and limit which systems can communicate with the RS-485 downstream devices.
  • Document and rehearse console-based recovery procedures in advance, since the device has no physical reset button and recovery is slow.
  • Maintain verified configuration backups so that the device can be restored quickly after a disruption.

Detection guidance

At a high level, operators can look for unexpected configuration changes to the gateway, unexplained loss of connectivity from the gateway or its downstream RS-485 devices, and management-interface access from unknown sources. Correlating network logs with change records can help distinguish legitimate administration from unauthorized activity.

Limitations of the available information

  • The record names the SenseLive X3050 in its description, while the affected list also includes a Senselive X3500 Firmware entry at version 1.523. The relationship between these entries is not explained in the record.
  • No fixed version, patch, or vendor remediation is listed.
  • The full CVSS 4.0 vector is not provided.
  • The specific parameters, values, and interface paths involved are not described, and this analysis does not add them.
  • The EPSS date in the record is later than the publication date, so the EPSS values should be read as the snapshot given in the record.

Frequently asked questions

What is the core problem in CVE-2026-27843?

According to the record, the SenseLive X3050 web management interface lets critical configuration parameters be changed without sufficient authentication or server-side validation, which can lead to a persistent lockout.

Is this CVE confirmed to be actively exploited?

No. The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Is a fixed version available?

The record does not list any fixed version. Operators should contact the vendor to confirm the remediation status.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.