SenseLive X3050 vulnerabilities

A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval and update operations to be performed without authentication or authorization. The service accepts firmware-related requests from any reachable host and does not verify user privileges or the integrity of uploaded images.

The SenseLive X3050 web management interface relies on unencrypted HTTP for all administrative communication. Authentication attempts and configuration data are transmitted in cleartext, allowing an attacker on the same network segment to intercept sensitive operational information.

The SenseLive X3050 web management interface does not properly enforce session lifetime, allowing authenticated sessions to remain active for extended periods without re-authentication. An attacker with access to a previously authenticated session can continue using administrative functions.