CVE-2026-27841 - Vulnerability Analysis

Overview

SenseLive X3050 contains a cross-site request forgery caused by lack of server-side validation and CSRF tokens in the web management interface, letting attackers trigger unauthorized state-changing operations via a malicious webpage, exploit requires user interaction.

Severity & Score

Impact

Attackers can cause users to submit unauthorized configuration requests, potentially altering device settings without consent.

Mitigation

Implement server-side validation of request origin and CSRF tokens in the web management interface.

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-12.json
• https://senselive.io/contact

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner