CVE-2026-40431 SenseLive X3050 Cleartext transmission of sensitive information
Attackers on the same network can intercept cleartext HTTP traffic to steal credentials and configuration data from the SenseLive X3050 web interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40431?
CVE-2026-40431 is a medium-severity vulnerability in SenseLive X3050, published on 23 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability exists in SenseLive X3050’s web management interface due to its reliance on unencrypted HTTP for all administrative communication. Because management traffic, including authentication attempts and configuration data, is transmitted in cleartext, an attacker with access to the same network segment could intercept or observe sensitive operational information.
Weakness: CWE-319
Which versions are affected by CVE-2026-40431?
It affects 1 product.
Products include Senselive X3500 Firmware.
How do I fix CVE-2026-40431?
No fix has been published for CVE-2026-40431 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-40431 being exploited?
There is no known exploitation of CVE-2026-40431 in the wild and no public exploit code.
Other vulnerabilities in SenseLive X3050
- CVE-2026-40620 SenseLive X3050 Missing authentication for critical function
- CVE-2026-35503 SenseLive X3050 Use of Hard-coded Credentials
- CVE-2026-39462 SenseLive X3050 Insufficiently Protected Credentials
- CVE-2026-40630 SenseLive X3050 Authentication bypass using an alternate path or channel
- CVE-2026-27843 SenseLive X3050 Missing authentication for critical function
Sources
Also known as GHSA-49v9-j5ff-rj5w.