by Kastro
Paper/Archive/CVE-2026-3893

CVE-2026-3893

Carlson Software VASCO-B GNSS Receiver — Carlson Software VASCO-B GNSS Receiver Missing Authentication for Critical Function

EPSS 0.4%CVSS 9.4
critical.is priorityof 100
35
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 31.3.313 × 206.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with network access to directly access and modify its configuration and operational functions without needing credentials.

Affected

ProductAffectedFixed inSource
VASCO-B GNSS Receiver< 1.4.01.4.0CNA

Scores by source

icscert (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refcarlsonsw.com/support-and-trainingrefcve.org/CVERecord?id=CVE-2026-3893refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-113-02.json