A critical authentication flaw in the SenseLive X3050 web management interface allows the system to retain insecure or default credentials even after an attempted password update, creating a significant risk of unauthorized access.

This vulnerability involves the insufficient protection of credentials, where the backend fails to consistently propagate password changes after a factory reset performed via the SenseLive Config 2.0 tool. The vulnerability is exploitable by an unauthenticated attacker with network access to the web management interface.

The inability to reliably enforce password changes poses a severe risk to operational security, as it renders administrative authentication mechanisms ineffective. Given the CVSS score of 8.1, this vulnerability represents a high risk: an attacker could maintain unauthorized access to the device despite administrator attempts to secure it, potentially leading to full system compromise or industrial process disruption.

Immediate Action: Since no vendor patch is currently available, contact SenseLive directly via their official support channels to request guidance or specialized firmware updates.

Proactive Monitoring: Monitor network access logs for the web management interface, specifically looking for unauthorized login attempts or administrative sessions originating from unknown or untrusted IP addresses.

Compensating Controls: Restrict access to the X3050 management interface to a dedicated, isolated management network or use a Web Application Firewall (WAF) to block external requests to the management port.

Public Exploit Available: Unknown.

Given the lack of a vendor-provided patch and the critical nature of the authentication failure, organizations using the SenseLive X3050 must assume that password changes cannot be trusted until verified. It is imperative to isolate these devices from external networks and strictly control administrative access until the vendor provides a formal resolution.