CVE-2026-3893

Carlson Software VASCO-B GNSS Receiver Missing Authentication for Critical Function

Published Apr 28, 2026 CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Description

The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism,
allowing an attacker with network access to directly access and modify
its configuration and operational functions without needing credentials.

Analysis

Technical impact

The VASCO-B GNSS Receiver fails to require authentication before allowing access to critical configuration and operational controls. As a result, an attacker who can reach the device over the network can alter its settings, divert its navigation data, or disrupt its operation without any credentials. This flaw enables a full redesign of the receiver’s behavior, potentially causing loss of service, data tampering, or misrouting of navigation signals.

Affected Systems

Devices manufactured by Carlson Software that run the VASCO‑B GNSS Receiver software with a version earlier than 1.4.0 are affected. The vendor recommends upgrading to version 1.4.0 or later to incorporate the authentication check.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.4, indicating a critical risk if exploited. The EPSS score is not available, but the lack of authentication makes exploitation trivial for an attacker with network access. The flaw is not listed in the CISA KEV catalog, yet it remains a high‑priority issue due to its potential impact on critical navigation infrastructure.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Carlson Software

VASCO-B GNSS Receiver

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.0
`1.4.0`	unaffected	—

No data.

Vendor Product Versions

Carlson Software

Vasco-b Gnss Receiver

Version	Status	Scheme	Platform
`[0,1.4.0)`	affected	generic	—
`1.4.0`	unaffected	semver	—

Remediation

Vendor Solution

Carlson Software recommends users update to Version 1.4.0 or greater. For more information contact Carlson Software https://www.carlsonsw.com/support-and-training/

OpenCVE Recommended Actions

Apply the latest firmware update, version 1.4.0 or later, to restore authentication for the receiver’s configuration interface.
Restrict network connectivity to the VASCO‑B device using firewalls or VLAN segmentation so that only trusted, authenticated sources can reach it.
Maintain physical and environmental security controls to prevent unauthorized tampering with the device’s hardware or firmware.

Generated by OpenCVE AI on April 28, 2026 at 23:13 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.373% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-02.json
https://www.carlsonsw.com/support-and-training/
https://www.cve.org/CVERecord?id=CVE-2026-3893

History

Apr 29, 2026 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 29, 2026 10:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Carlson Software Carlson Software vasco-b Gnss Receiver
Vendors & Products		Carlson Software Carlson Software vasco-b Gnss Receiver

Apr 28, 2026 7:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with network access to directly access and modify its configuration and operational functions without needing credentials.
Title		Carlson Software VASCO-B GNSS Receiver Missing Authentication for Critical Function
Weaknesses		CWE-306
References		https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-02.json https://www.carlsonsw.com/support-and-training/ https://www.cve.org/CVERecord?id=CVE-2026-3893
Metrics		cvssV3_1 `{'score': 9.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H'}`