CVE-2026-39462

Katalog CVE

CVSS 8.1 · High EPSS 0,69%

Kerentanan Insufficiently Protected Credentials pada senselive x3500 firmware. Skor CVSS 3.1 8.1 (High) menurut hq.dhs.gov.

Deskripsi (NVD)

A vulnerability exists in SenseLive X3050’s web management interface in which password updates are not reliably applied due to improper handling of credential changes on the backend. After the device undergoes a factory restore using the SenseLive Config 2.0 tool, the interface may indicate that the password update was successful; however, the system may continue to accept the previous or default credentials, demonstrating that the password-change process is not consistently enforced. Even after a factory reset, attempted password changes may fail to propagate correctly.

Rincian

Terbit di NVD

24 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber hq.dhs.gov
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

0,69% peluang dieksploitasi; lebih tinggi dari 51,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12 pemerintah AS
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-12.json advisory pihak ketiga
• https://senselive.io/contact product