PatchSiren cyber security CVE debrief

CVE-2026-35503 Raw CVE debrief

CVE-2026-35503 is a critical weakness in the SenseLive X3050 V1.523 web management interface. According to CISA, the authentication logic is performed on the client side with hardcoded values in browser-executed scripts instead of being verified server-side. That design allows someone who can access the login page to recover the exposed parameters and gain unauthorized administrative access. Because the issue affects the management plane, it should be treated as high-priority for OT/ICS environments and any deployment where the device interface is reachable from a broader network segment. CISA also notes that SenseLive did not respond to its coordination request, so defenders should not assume a vendor fix is immediately available.

Vendor: Raw
Product: SenseLive X3050 V1.523
CVSS: CRITICAL 9.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-04-21
Original CVE updated: 2026-04-21
Advisory published: 2026-04-21
Advisory updated: 2026-04-21

Who should care

OT/ICS operators, network and system administrators, security teams, and asset owners using SenseLive X3050 V1.523 devices or exposing their web management interface.

Technical summary

CISA’s advisory describes a login flaw in which authentication is handled entirely in browser-executed code, with hardcoded values that can be retrieved by an attacker who can reach the login page. Because the server does not appear to perform the decisive authentication check, the attacker may be able to bypass normal login controls and access administrative functionality. The advisory maps the weakness to CWE-798 (Use of Hard-coded Credentials) and rates the issue at CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Defensive priority

Urgent. Protect or remove exposure of the management interface immediately, because the flaw can allow unauthorized administrative access without credentials if the login page is reachable.

Recommended defensive actions

Restrict access to the X3050 web management interface to trusted administrative networks only.
Place the device behind VPN, jump hosts, or other access controls; do not leave management services broadly reachable.
Review device inventories for SenseLive X3050 V1.523 deployments and confirm whether the affected interface is exposed.
Monitor for unexpected administrative logins, configuration changes, and other signs of unauthorized access.
Apply any vendor guidance or firmware update that becomes available through SenseLive; CISA notes the vendor did not respond to coordination requests.
Follow CISA industrial control system hardening guidance and defense-in-depth practices for management-plane services.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-26-111-12 (published 2026-04-21), which states that the X3050 web management interface performs authentication client-side using hardcoded values in browser-executed scripts rather than server-side verification. The advisory says an attacker who can access the login page may retrieve the exposed parameters and gain unauthorized administrative access. The advisory also records SSVCv2/E:N/A:N/2026-04-20T06:00:00.000000Z and notes that SenseLive did not respond to CISA’s coordination request.

Official resources

Publicly disclosed by CISA in advisory ICSA-26-111-12 on 2026-04-21. CISA notes SenseLive did not respond to its coordination request.