PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-27841 SenseLive CVE debrief

CVE-2026-27841 is a high-severity CSRF issue in the SenseLive X3050 V1.523 web management interface. The advisory says the application does not validate request origin or use CSRF tokens, so a malicious external webpage could cause a logged-in user’s browser to submit unauthorized configuration changes. In practical terms, this is an integrity-focused risk for device administration and can also affect availability if attacker-driven settings changes disrupt operation.

Vendor
SenseLive
Product
X3050
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-21
Original CVE updated
2026-04-21
Advisory published
2026-04-21
Advisory updated
2026-04-21

Who should care

Operators, integrators, and administrators responsible for SenseLive X3050 devices, especially where the web management interface is reachable from untrusted networks or used by staff who browse the web while authenticated to the device.

Technical summary

The source advisory describes a missing CSRF defense in the X3050 web management interface: no server-side origin validation and no CSRF tokens. The supplied CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, scored 8.1 (High). The issue maps to CWE-352 and requires user interaction, but no privileges beyond the victim’s authenticated browser session are indicated in the advisory.

Defensive priority

High. Prioritize if the management interface is exposed beyond a tightly controlled admin network, or if administrators may access it while browsing untrusted sites. Even though user interaction is required, the impact includes unauthorized state changes to the device.

Recommended defensive actions

  • Restrict access to the X3050 web management interface to trusted admin networks or a VPN only.
  • Use separate, dedicated admin browsing profiles or workstations for device administration.
  • Do not leave administrative sessions open longer than necessary; re-authenticate when practical.
  • Monitor configuration and access logs for unexpected state changes or suspicious admin activity.
  • Follow CISA ICS recommended practices and defense-in-depth guidance for segmentation and access control.
  • Contact SenseLive for product-specific mitigation or update guidance, as referenced in the advisory.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-26-111-12, published 2026-04-21, which identifies CVE-2026-27841 in SenseLive X3050 V1.523. The advisory text states that state-changing requests can be triggered without proper CSRF protections because the application lacks request-origin validation and CSRF tokens. The source also includes the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, score 8.1, and notes that SenseLive did not respond to CISA’s coordination requests.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-27841 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-27841

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-27841 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-27841

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-111-12.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.