CVE-2026-39462

High

Published: 24 April 2026

Published

24 April 2026

Modified

28 April 2026

KEV Added

—

Patch

—

CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0005 14.2th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-39462 is a high-severity Insufficiently Protected Credentials (CWE-522) vulnerability in Senselive X3500 Firmware. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 14.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Valid Accounts (T1078) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

IA-5 Authenticator Management good match

prevent

Directly mandates proper management of authenticators including enforcement of password changes and protection against use of outdated or default credentials, addressing the core failure in credential propagation.

SI-2 Flaw Remediation good match

prevent

Requires identification, reporting, and remediation of flaws like the improper backend handling of password updates, preventing exploitation via unchanged credentials post-factory restore.

AC-2 Account Management partial match

prevent

Ensures systematic management of accounts and associated credentials, including modifications and disabling inactive ones, to mitigate risks from unreliable password enforcement in the web interface.

MITRE ATT&CK Enterprise TechniquesAI

T1078 Valid Accounts Stealth

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1133 External Remote Services Persistence

Adversaries may leverage external-facing remote services to initially access and/or persist within a network.

attack.mitre.org →

Why these techniques?

Vulnerability in web management interface allows remote authentication using default/previous credentials due to failed password updates (CWE-522), directly enabling initial access via valid accounts (T1078, T1078.001) on a public-facing application (T1190) and external remote service (T1133).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability exists in SenseLive X3050’s web management interface in which password updates are not reliably applied due to improper handling of credential changes on the backend. After the device undergoes a factory restore using the SenseLive Config 2.0 tool,…

the interface may indicate that the password update was successful; however, the system may continue to accept the previous or default credentials, demonstrating that the password-change process is not consistently enforced. Even after a factory reset, attempted password changes may fail to propagate correctly.

Deeper analysisAI

CVE-2026-39462 is a vulnerability in the web management interface of the SenseLive X3050 device, stemming from improper handling of credential changes on the backend (CWE-522: Insufficiently Protected Credentials). Password updates are not reliably applied, particularly after a factory restore using the SenseLive Config 2.0 tool. In such cases, the interface may report a successful password change, but the system continues to accept previous or default credentials. This issue persists even after factory resets, as attempted password changes fail to propagate correctly. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

A remote attacker with network access to the SenseLive X3050 can exploit this vulnerability without privileges or user interaction, though it requires high attack complexity. By leveraging the failure of password changes to take effect—especially post-factory restore—the attacker can authenticate to the web management interface using unchanged previous or default credentials. Successful exploitation grants high-impact access, enabling confidentiality breaches, integrity modifications, and availability disruptions on the affected device.

For mitigation details, refer to CISA ICS Advisory ICSA-26-111-12 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12), the vendor contact page (https://senselive.io/contact), and the associated CSAF document (https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-12.json). These resources provide guidance from CISA and SenseLive on addressing the issue.