CVE-2026-25775

Critical

Published: 24 April 2026

Published

24 April 2026

Modified

24 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0011 28.1th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-25775 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Senselive (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and MA-4 (Nonlocal Maintenance).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

MA-4 Nonlocal Maintenance good match

prevent

Requires approval, strong authentication, and management of nonlocal maintenance sessions for firmware retrieval and updates, directly mitigating the unauthenticated remote management service.

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations and access control for firmware operations, addressing the lack of authentication, authorization, and privilege verification in the service.

SI-7 Software, Firmware, and Information Integrity good match

preventdetect

Verifies integrity and authenticity of firmware images prior to updates and detects unauthorized firmware alterations, countering the absence of checks on uploaded images.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1542.001 System Firmware Stealth

Adversaries may modify system firmware to persist on systems.

attack.mitre.org →

T1542.002 Component Firmware Stealth

Adversaries may modify component firmware to persist on systems.

attack.mitre.org →

Why these techniques?

Unauthenticated remote firmware retrieval/update on a reachable management service directly enables public-facing application exploitation (T1190) and facilitates malicious system/component firmware deployment for persistence or impact (T1542.001/T1542.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval and update operations to be performed without authentication or authorization. The service accepts firmware-related requests from any reachable host and does not verify user privileges, integrity of uploaded images,…

or the authenticity of provided firmware.

Deeper analysisAI

CVE-2026-25775 is a vulnerability in the remote management service of SenseLive X3050 that enables firmware retrieval and update operations without authentication or authorization. The service accepts firmware-related requests from any reachable host and does not verify user privileges, the integrity of uploaded images, or the authenticity of provided firmware. Published on 2026-04-24, it has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-306 (Missing Authentication for Critical Function).

An attacker requires only network access to the affected service, with no privileges, user interaction, or special complexity needed for exploitation. Successful attacks allow retrieval of the current firmware, compromising high confidentiality, and uploading arbitrary firmware images without checks, enabling high integrity and availability impacts through deployment of malicious firmware.

Mitigation guidance is available in related advisories, including CISA ICSA-26-111-12 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12, the corresponding CSAF JSON file at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-12.json, and SenseLive contact information at https://senselive.io/contact.