SenseLive X3050 Cross-Site Request Forgery Vulnerability in Web Management Interface

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the web management interface of the SenseLive X3050. This issue allows state-changing operations to be executed without adequate CSRF protections. The vulnerability arises because the application fails to enforce server-side validation of request origins or implement CSRF tokens. As a result, a malicious external webpage could potentially manipulate a user's browser into sending unauthorized configuration requests to the device.

Impact

Exploitation of this vulnerability could lead to unauthorized configuration changes on the affected device.

Remediation

SenseLive did not respond to CISA's requests to coordinate. Affected users are encouraged to reach out to SenseLive for more information.