CVE-2026-39462

A vulnerability exists in SenseLive X3050’s web management interface in which password updates are not reliably applied due to improper handling of credential changes on the backend. After the device undergoes a factory restore using the SenseLive Config 2.0 tool, the interface may indicate that the password update was successful; however, the system may continue to accept the previous or default credentials, demonstrating that the password-change process is not consistently enforced. Even after a factory reset, attempted password changes may fail to propagate correctly.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-12.json	Third Party Advisory
https://senselive.io/contact	Product
https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12	US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:senselive:x3500_firmware:1.523:*:*:*:*:*:*:*

cpe:2.3:h:senselive:x3500:-:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad existe en la interfaz de gestión web de SenseLive X3050 en la que las actualizaciones de contraseña no se aplican de forma fiable debido a un manejo inadecuado de los cambios de credenciales en el backend. Después de que el dispositivo se somete a una restauración de fábrica utilizando la herramienta SenseLive Config 2.0, la interfaz puede indicar que la actualización de contraseña fue exitosa; sin embargo, el sistema puede seguir aceptando las credenciales anteriores o predeterminadas, demostrando que el proceso de cambio de contraseña no se aplica de forma consistente. Incluso después de un restablecimiento de fábrica, los intentos de cambio de contraseña pueden no propagarse correctamente.

Information

Published : 2026-04-24 00:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-39462

Mitre link : CVE-2026-39462

CVE.ORG link : CVE-2026-39462

JSON object : View

Products Affected

senselive

x3500_firmware
x3500

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2026-39462", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39462", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-24T16:48:32.907201Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ics-cert@hq.dhs.gov", "affectedData": [{"vendor": "SenseLive", "product": "X3050", "versions": [{"status": "affected", "version": "V1.523"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-24T00:16:28.333", "references": [{"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-12.json", "tags": ["Third Party Advisory"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://senselive.io/contact", "tags": ["Product"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12", "tags": ["US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability exists in\u00a0SenseLive X3050\u2019s web management interface in which password updates are not reliably applied due to improper handling of credential changes on the backend. After the device undergoes a factory restore using the SenseLive Config 2.0 tool, the interface may indicate that the password update was successful; however, the system may continue to accept the previous or default credentials, demonstrating that the password-change process is not consistently enforced. Even after a factory reset, attempted password changes may fail to propagate correctly."}, {"lang": "es", "value": "Una vulnerabilidad existe en la interfaz de gesti\u00f3n web de SenseLive X3050 en la que las actualizaciones de contrase\u00f1a no se aplican de forma fiable debido a un manejo inadecuado de los cambios de credenciales en el backend. Despu\u00e9s de que el dispositivo se somete a una restauraci\u00f3n de f\u00e1brica utilizando la herramienta SenseLive Config 2.0, la interfaz puede indicar que la actualizaci\u00f3n de contrase\u00f1a fue exitosa; sin embargo, el sistema puede seguir aceptando las credenciales anteriores o predeterminadas, demostrando que el proceso de cambio de contrase\u00f1a no se aplica de forma consistente. Incluso despu\u00e9s de un restablecimiento de f\u00e1brica, los intentos de cambio de contrase\u00f1a pueden no propagarse correctamente."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:senselive:x3500_firmware:1.523:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0A28FFE-3268-48DC-BB85-77009904F0D0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:senselive:x3500:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "42742F99-96EF-412E-9D7C-8C2155C3DCE1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}