---
cve: "CVE-2026-40630"
severity: "CRITICAL"
cvss: 9.3
epss: "0.9%"
vendor: "SenseLive"
kev: false
exploited: false
published: "2026-04-23 23:45:46"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-10-20T00:52:37+02:00"
---

# CVE-2026-40630

> 9.3 CRITICAL · 🧪 PoC

## Beschreibung

A vulnerability in 
SenseLive 

X3050’s web management interface allows unauthorized access to certain configuration endpoints due to improper access control enforcement. An attacker with network access to the device may be able to bypass the intended authentication mechanism and directly interact with sensitive configuration functions.

## CNA-Record (Kanon, cvelistV5)

- CNA: **icscert**
- State: PUBLISHED
- Stand: 2026-04-24 13:11:46
- CNA-CVSS: **9.3** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-288** — Authentication Bypass Using an Alternate Path or Channel
  The product requires authentication, but the product has an alternate path or channel that does not require authentication.

## Angriffsmuster (CAPEC)

- [CAPEC-127 — Directory Indexing](https://capec.mitre.org/data/definitions/127.html) _(Severity: Medium)_
- [CAPEC-665 — Exploitation of Thunderbolt Protection Flaws](https://capec.mitre.org/data/definitions/665.html) _(Severity: Very High)_

## ATT&CK-Techniken

- [T1083 — File and Directory Discovery](https://attack.mitre.org/techniques/T1083/)
- [T1211 — Exploitation for Defensive Evasion](https://attack.mitre.org/techniques/T1211/)
- [T1542.002 — Pre-OS Boot: Component Firmware](https://attack.mitre.org/techniques/T1542/002/)
- [T1556 — Modify Authentication Process](https://attack.mitre.org/techniques/T1556/)

## Referenzen

- <https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-12>
- <https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-12.json>
- <https://senselive.io/contact>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-40630/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_