## Summary
CVE-2026-39462 affects the SenseLive X3050 web management interface (firmware 1.523) where password updates are not reliably enforced. After using the SenseLive Config 2.0 tool to perform a factory restore, the UI may report a successful password change while the device may still accept previous or default credentials.
## Technical Details
- Root issue (per NVD): improper handling of credential changes on the backend causes password updates to fail to propagate consistently.
- Post-restore behavior: after factory restore via SenseLive Config 2.0, the interface may indicate the password update succeeded, but the system may continue to accept prior/default credentials.
- Even after a factory reset, attempted password changes may fail to propagate correctly.
- CWE: CWE-522 (Insufficiently Protected Credentials).
- Attack prerequisites (from CVSS vector): network access with no privileges required (PR:N) and no user interaction (UI:N).
## Affected
- SenseLive X3050 firmware 1.523
## Impact
- Authentication bypass / credential persistence: attackers may be able to log in using previous or default credentials even after an attempted password change.
- High impact on confidentiality, integrity, and availability (CVSS 8.1 vector indicates C:H/I:H/A:H).
## Mitigation
1. Patch immediately: apply the vendor’s fixed firmware for SenseLive X3050 (not provided in the supplied references).
2. If a patch is not yet available, treat password-change results after factory restore as untrusted; assume previous/default credentials may still work.
3. Restrict network access to the web management interface to reduce exposure (CVSS indicates network-reachable).
4. Validate authentication behavior after any credential change and after factory restore (confirm that old/default credentials no longer authenticate).
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-522