SenseLive X3050 Missing Authentication Vulnerability in Remote Management Service
Vulnerability
A vulnerability exists in the SenseLive X3050 remote management service, allowing firmware retrieval and update operations to be conducted without authentication or authorization. The service accepts firmware-related requests from any reachable host and fails to verify user privileges, the integrity of uploaded images, or the authenticity of the provided firmware. This vulnerability affects SenseLive X3050 version 1.523.
Impact
Exploitation of this vulnerability could allow an attacker to gain complete control of the device.
Remediation
SenseLive did not respond to CISA's requests to coordinate. Affected users are encouraged to reach out to SenseLive for more information.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.