CVE-2026-35503

Critical

Published: 24 April 2026

Published

24 April 2026

Modified

28 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0007 21.1th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-35503 is a critical-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Senselive X3500 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-5 (Authenticator Management).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

AC-3 mandates server-side enforcement of access control policies, directly preventing authentication bypass via client-side hardcoded values.

IA-5 Authenticator Management good match

prevent

IA-5 requires proper management of authenticators, prohibiting the embedding of hardcoded credentials in client-side JavaScript scripts.

SI-2 Flaw Remediation good match

preventrecover

SI-2 ensures flaws like client-side-only authentication are identified, reported, and corrected promptly to mitigate exploitation risks.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability is a client-side authentication bypass with hardcoded credentials in a publicly accessible web management interface, directly enabling remote exploitation for unauthorized administrative access without credentials or interaction.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability in SenseLive X3050’s web management interface allows authentication logic to be performed entirely on the client side, relying on hardcoded values within browser-executed scripts rather than server-side verification. An attacker with access to the login page could retrieve…

these exposed parameters and gain unauthorized access to administrative functionality.

Deeper analysisAI

CVE-2026-35503 is a critical vulnerability in the web management interface of SenseLive X3050 devices. The flaw arises from authentication logic being performed entirely on the client side, relying on hardcoded values embedded in browser-executed JavaScript rather than server-side verification. This design exposes sensitive parameters that an attacker can extract directly from the login page, corresponding to CWE-798 (Use of Hard-coded Credentials). Published on 2026-04-24, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its high severity due to network accessibility and comprehensive impact potential.

Any remote attacker with access to the device's login page can exploit this vulnerability without privileges or user interaction. By inspecting the client-side scripts, they can retrieve the hardcoded authentication parameters and bypass login controls to gain unauthorized access to administrative functionality. Successful exploitation enables high-level confidentiality, integrity, and availability impacts, such as data exfiltration, configuration changes, or service disruption.

Mitigation guidance is detailed in official advisories, including CISA ICSA-26-111-12 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12 and the corresponding CSAF JSON file at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-12.json. Vendors can be contacted via https://senselive.io/contact for patch information or support.