The vulnerability permits a low‑privileged attacker who can send Modbus packets to the GPL750-based odorizers to alter register values that control odorant injection. By modifying these values, the attacker can cause the device to inject either too much or too little odorant into a gas line, compromising the intended masking of hazardous substances and potentially exposing personnel and the environment to harmful conditions. The weakness corresponds to CWE‑306, missing authentication for a critical control function.

Affected devices are the GPL Odorizers GPL750 series, specifically the XL4, XL4 Prime, XL7, and XL7 Prime models. Firmware updates—Horner Automation version 15.76 for the XL series and version 17.30 for the XL Prime series—are available through the vendor’s repository. Administrators should remove older firmware files from the device’s microSD card, retaining only the LOGS folder and the FIRMWARE.LIC file if a WebMI license is used. The compressed update package can be extracted to the root of the microSD card, or technicians can provide preconfigured SD cards if management lacks IT permissions.

The impact is rated moderate to high with a CVSS score of 8.6. EPSS data is not provided and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote Modbus communication over the device’s network interface or serial link; this inference is based on the description’s mention of Modbus packet manipulation. Exploitation requires only low‑privilege access to the Modbus network, making the threat realistic in environments where these devices are not protected by network segmentation or authentication.