CVE-2026-27843

A vulnerability exists in SenseLive X3050's web management interface that allows critical configuration parameters to be modified without sufficient authentication or server-side validation. By applying unsupported or disruptive values to recovery mechanisms and network settings, an attacker can induce a persistent lockout state. Because the device lacks a physical reset button, recovery requires specialized technical access via the console to perform a factory reset, resulting in a total denial-of-service for the gateway and its connected RS-485 downstream systems.

• CWE-306

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-12.jsonThird Party Advisory
• https://senselive.io/contactProduct
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12US Government Resource

Published

Apr 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27838wger is a free, open-source workout and fitness manager. Fiv…3.5
• CVE-2026-27839wger is a free, open-source workout and fitness manager. In …4.3
• CVE-2026-2784Mitigation bypass in the DOM: Security component. This vulne…9.8
• CVE-2026-27840ZITADEL is an open source identity management platform. Star…4.3
• CVE-2026-27841A vulnerability in SenseLive X3050's web management interfac…8.4
• CVE-2026-27842Authentication bypass issue exists in MR-GM5L-S1 and MR-GM5A…9.8
• CVE-2026-27844Uncaught Exception (CWE-248) in the Controller 6000 and Cont…2.7
• CVE-2026-27846Due to missing authentication, a user with physical access t…6.2
• CVE-2026-27847Due to improper neutralization of special elements, SQL stat…9.8
• CVE-2026-27848Due to missing neutralization of special elements, OS comman…9.8
• CVE-2026-27849Due to missing neutralization of special elements, OS comman…9.8
• CVE-2026-2785Invalid pointer in the JavaScript Engine component. This vul…9.8